Russian State-Sponsored Hackers Breach Microsoft Execs' Emails

Microsoft discloses a sophisticated nation-state cyber attack by a Russian APT group, Midnight Blizzard, resulting in the theft of emails and attachments from senior executives and other individuals in the company's cybersecurity and legal departments. The attack, which began in late November 2023, involved a password spray attack to compromise a legacy non-production test tenant account. While the exact number of email accounts infiltrated and the information accessed were not disclosed, Microsoft emphasized that the breach did not stem from any security vulnerability in its products and that there is no evidence of access to customer environments, production systems, source code, or AI systems.