Senior Leaders’ Emails Accessed by State-Sponsored Attackers, Microsoft Confirms

Microsoft has revealed that a cyber attack by a nation-state backed group called Midnight Blizzard took place in November 2023. The group accessed some Microsoft corporate emails and documents through compromised email accounts. The attackers utilized a legacy test tenant account to gain access and were able to access a small number of corporate email accounts, including those of senior leadership team members and individuals in cybersecurity and legal teams. However, there is no evidence that the threat actors had access to customer environments, production systems, source code, or AI systems. Microsoft will notify customers if any action is required.

In a separate development, HPE also reported being breached by the Midnight Blizzard group, with data taken from their cloud-based email environment from May 2023. While investigations are still ongoing, it is unclear if the attacks on HPE and Microsoft are related.

The attack on Microsoft’s email accounts was carried out using a technique known as a password spray attack. This involves spamming commonly used passwords against multiple accounts within an organization to gain unauthorized access. To defend against such attacks, organizations are advised to implement multifactor authentication, keep track of older and test accounts, and use up-to-date SIEM software. Companies should also educate employees on the importance of strong passwords, 2FA, and the risks of social engineering attacks and insecure password sharing.

Nation-state actors pose a significant cybersecurity threat in 2024, highlighting the need for thorough incident response plans and threat intelligence monitoring, especially for organizations that might be specifically targeted. Microsoft acknowledges the need to strike a balance between security and business risk, stating that their incident has prompted them to apply their current security standards to legacy systems and internal processes, even if it causes disruptions.

TechRepublic contacted Microsoft for further information, and the company directed them to their blog post for updates.

Unlock your business potential with our expert guidance. Get in touch now!

tra_20241209-the-complete-2025-comptia-certification-training-super-bundle-by-idunova.jpg

Get Ready for 2025 with Our CompTIA Training Bundle for Just $50!

stateless-firewall-featured-image-12052024-min.png

5 Benefits of Implementing a Stateless Firewall (and 3 Important Limitations)

AdobeStock_315682413.jpg

Chief AI Officers: The Key Players in AI Success

AdobeStock_272603267.jpg

How Employee Data Access Habits Are Impacting Australian Employers Negatively

teamwork-collaboration-businesspeople-Friends-Stock-adobe.jpg

UK Medical Trial of Four-Day Work Week Shows Increased Staff Happiness and Productivity

tr_20241205-uk-cyber-risks-underestimated.jpg

UK Cyber Risks Are ‘Significantly Underestimated,’ Cautions Security Chief

Online-shopping-retail-adobe.jpg

Tech Strategy Uncovered: Insights from Dan Lake, Vice President at Notonthehighstreet.com