Jan 25, 2024
0 new incidents, 1 with updates.
Updated
- ClosedHighNo fix needed
Midnight Blizzard breaches Microsoft corporate email
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Microsoft corporate email (Microsoft 365)Closed Apr 2, 2024
