Midnight Blizzard breaches Microsoft corporate email
Microsoft corporate email (Microsoft 365)
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Why this severity: Nation-state espionage (APT29)
- Started
- Jan 12, 2024
- Closed
- Apr 2, 2024
Affected
Not published yet
Fixed in
No fixed release yet
Updates by day3
▸Apr 2, 2024
Link #CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed
Source
▸Jan 25, 2024
Link #Microsoft publishes guidance for responders on the Midnight Blizzard attack
Source
▸Jan 12, 2024
Link #Microsoft detects a nation-state attack on its corporate systems
Source
Advisories1
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
