ClosedHighNo fix needed
Day · Jan 25, 2024
Midnight Blizzard breaches Microsoft corporate email
Microsoft corporate email (Microsoft 365)
Updates on Jan 25, 2024
Microsoft publishes guidance for responders on the Midnight Blizzard attack
Source
Summary
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Read the full incident →
