https://pwn.watch/t/password-spraying Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Tue, 02 Apr 2024 00:00:00 GMT https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach Tue, 02 Apr 2024 00:00:00 GMT high <p>Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2024-04-02: CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed (<a href="https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system">source</a>)</li><li>2024-01-25: Microsoft publishes guidance for responders on the Midnight Blizzard attack (<a href="https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/">source</a>)</li><li>2024-01-12: Microsoft detects a nation-state attack on its corporate systems (<a href="https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/">source</a>)</li></ul>