{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T03:54:42.456Z",
  "tag": {
    "id": "password-spraying",
    "label": "Password spraying",
    "isStack": false,
    "url": "https://pwn.watch/t/password-spraying",
    "feed": "https://pwn.watch/t/password-spraying/feed.xml"
  },
  "counts": {
    "incidents": 1,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 1
  },
  "incidents": [
    {
      "slug": "microsoft-midnight-blizzard-corporate-email-breach",
      "title": "Midnight Blizzard breaches Microsoft corporate email",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach",
      "json": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Microsoft corporate email (Microsoft 365)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "midnight-blizzard",
        "espionage",
        "password-spraying",
        "data-breach",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-01-12",
      "closedAt": "2024-04-02",
      "updatedAt": "2024-04-02",
      "summary": "Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-02",
      "title": "CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-25",
      "title": "Microsoft publishes guidance for responders on the Midnight Blizzard attack",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-12",
      "title": "Microsoft detects a nation-state attack on its corporate systems",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    }
  ]
}