ClosedHighNo fix needed
Day · Jan 12, 2024
Midnight Blizzard breaches Microsoft corporate email
Microsoft corporate email (Microsoft 365)
Updates on Jan 12, 2024
Microsoft detects a nation-state attack on its corporate systems
Source
Summary
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Read the full incident →
