# Midnight Blizzard breaches Microsoft corporate email · pwn.watch

> Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Page: https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach · generated 2026-10-22T22:00:08.805Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Microsoft corporate email (Microsoft 365)
- Started: 2024-01-12 · closed: 2024-04-02

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach/feed.xml
- JSON Feed: https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json
- This file: https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach/llms.txt

## Updates (newest first)
- 2024-04-02: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed (https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system)
- 2024-01-25: Microsoft publishes guidance for responders on the Midnight Blizzard attack (https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/)
- 2024-01-12: Microsoft detects a nation-state attack on its corporate systems (https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/)

## Fix brief
# Security brief: Midnight Blizzard breaches Microsoft corporate email

Source: https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach · status: closed (closed Apr 2, 2024) · severity: high · updated Apr 2, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Severity detail: Nation-state espionage (APT29)

- Product: Microsoft corporate email (Microsoft 365)

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Apr 2, 2024: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed
- Jan 25, 2024: Microsoft publishes guidance for responders on the Midnight Blizzard attack
- Jan 12, 2024: Microsoft detects a nation-state attack on its corporate systems

## Advisories
- [ED 24-02: Mitigating the significant risk from nation-state compromise of Microsoft corporate email system](https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system) (CISA)

## Write-ups & news
- [Midnight Blizzard: guidance for responders on nation-state attack](https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/)

---
Machine-readable: https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.