Microsoft reveals company hacked by Russian-backed group.
Microsoft revealed that some of its corporate email accounts were hacked by a Russian-backed group. Its security team detected the attack on Jan. 12 and quickly identified the group responsible: Midnight Blizzard, “the Russian state-sponsored actor also known as Nobelium.”
The group allegedly used a “password spray attack,” where a user uses a single common password against multiple accounts on the same application, to “compromise a legacy non-production test tenant account and gain a foothold,” according to Microsoft.
The group then “used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents,” the company said.
The hackers allegedly were targeting email accounts for information related to Midnight Blizzard, Microsoft said. Microsoft was able to remove the hacker’s access to the email accounts on Jan. 13, according to a company filing with the SEC.
“To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code, or AI systems. We will notify customers if any action is required,” the company said.
The company said it is in the process of informing its affected users.
The investigation is ongoing.