Microsoft has revealed that a cyber attack by a nation-state backed group called Midnight Blizzard took place in November 2023. The group accessed some Microsoft corporate emails and documents through compromised email accounts. The attackers utilized a legacy test tenant account to gain access and were able to access a small number of corporate email accounts, including those of senior leadership team members and individuals in cybersecurity and legal teams. However, there is no evidence that the threat actors had access to customer environments, production systems, source code, or AI systems. Microsoft will notify customers if any action is required.
In a separate development, HPE also reported being breached by the Midnight Blizzard group, with data taken from their cloud-based email environment from May 2023. While investigations are still ongoing, it is unclear if the attacks on HPE and Microsoft are related.
The attack on Microsoft’s email accounts was carried out using a technique known as a password spray attack. This involves spamming commonly used passwords against multiple accounts within an organization to gain unauthorized access. To defend against such attacks, organizations are advised to implement multifactor authentication, keep track of older and test accounts, and use up-to-date SIEM software. Companies should also educate employees on the importance of strong passwords, 2FA, and the risks of social engineering attacks and insecure password sharing.
Nation-state actors pose a significant cybersecurity threat in 2024, highlighting the need for thorough incident response plans and threat intelligence monitoring, especially for organizations that might be specifically targeted. Microsoft acknowledges the need to strike a balance between security and business risk, stating that their incident has prompted them to apply their current security standards to legacy systems and internal processes, even if it causes disruptions.
TechRepublic contacted Microsoft for further information, and the company directed them to their blog post for updates.
