ClosedHighNo fix needed
Day · Apr 2, 2024
Midnight Blizzard breaches Microsoft corporate email
Microsoft corporate email (Microsoft 365)
Updates on Apr 2, 2024
CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed
Source
Summary
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Read the full incident →
