Microsoft Midnight Blizzard: Password Spray Reaches Senior Leadership Email

Incident summary

Microsoft disclosed in a January 19, 2024 SEC 8-K filing and MSRC blog post that it had detected a nation-state attack on its corporate systems on January 12, 2024. The threat actor, identified as Midnight Blizzard (also known as NOBELIUM, APT29, and Cozy Bear), is associated with Russia's Foreign Intelligence Service (SVR). The same actor was responsible for the SolarWinds Sunburst campaign in 2020.

Per Microsoft's January 25, 2024 technical analysis, Midnight Blizzard used password spray attacks tailored to a low number of accounts and a low attempt volume per account to evade detection. The actor compromised a legacy non-production test tenant account that did not have multifactor authentication enabled. The compromised account had access to a legacy OAuth application granted elevated Exchange Online permissions.

The actor used the OAuth application to access mailboxes belonging to Microsoft senior leadership, the cybersecurity team, the legal team, and other functions. Microsoft confirmed in a March 8, 2024 update that Midnight Blizzard had also accessed source code repositories and internal systems beyond email, expanding the disclosed scope significantly from the initial January announcement.

Attack technique

MITRE ATT&CK maps the entry to T1110.003 (Brute Force: Password Spraying). Midnight Blizzard tradecraft on this campaign emphasized low-and-slow operations: a small number of attempts per account spread across many accounts and obscured behind residential proxy infrastructure to defeat impossible-travel and volume-based detections.

After authenticating to the legacy test tenant, the actor pivoted to a legacy OAuth application that had been granted full_access_as_app to Office 365 Exchange Online during early product testing, then never deprovisioned. T1098.001 (Account Manipulation: Additional Cloud Credentials) and T1528 (Steal Application Access Token) describe how the actor created additional credentials for the OAuth application and used those credentials to mint tokens with elevated mailbox access scope.

The OAuth application's full_access_as_app permission allowed access to mailboxes across the Microsoft corporate tenant, not just the legacy test tenant. This privilege boundary failure is the core architectural lesson. T1114.002 (Email Collection: Remote Email Collection) describes the EWS API queries the actor used to collect emails and attachments from senior leadership mailboxes.

Impact and consequences

Microsoft confirmed in its January 19, 2024 disclosure that Midnight Blizzard exfiltrated emails and attachments from senior leadership mailboxes including parts of cybersecurity, legal, and other functions. The March 8, 2024 update confirmed that the actor had used information from those exfiltrated emails to gain or attempt to gain access to additional Microsoft systems, including some source code repositories.

CISA issued Emergency Directive 24-02 on April 2, 2024 ordering federal civilian agencies to analyze whether emails sent to or received from Microsoft corporate accounts known to be in Midnight Blizzard's possession contained authentication tokens, credentials, or sensitive information that required rotation. ED 24-02 was the first emergency directive issued because of a vendor email compromise, marking a precedent for federal action on commercial vendor breaches.

The incident, combined with the Storm-0558 incident in 2023, drove the April 2, 2024 CSRB report on Storm-0558 to expand its critique of Microsoft security culture to recommend industry-wide reforms. Microsoft's expanded Secure Future Initiative announcement in November 2023 was further accelerated and connected to executive compensation in May 2024, tying security outcomes to senior leadership pay.

Indicators of Compromise

Specific artifacts defenders should hunt for. Cross-reference these against your existing detection rules before acting on them.

Lessons for defenders

Legacy non-production tenants are production risk. The compromised account belonged to a legacy test tenant that had not been hardened to current standards, did not have MFA enforced, and contained a forgotten OAuth application with broad permissions. Inventory all tenants, decommission unused tenants, and apply baseline security controls to every tenant including test environments.

OAuth application permissions outlive their use cases. The OAuth application Midnight Blizzard abused had been granted full_access_as_app for testing during product development and then forgotten. Periodic review of OAuth applications, automated detection of high-privilege OAuth grants, and short-lived OAuth permissions reduce this attack surface.

Password spray is a low-noise floor. The actor evaded detection by keeping per-account attempts low and using residential proxies. Detection engineering for password spray needs to baseline tenant-wide login patterns and account-level entropy rather than relying on per-account thresholds. UEBA-style detections that compare attempt rate distributions across populations catch low-volume spray.

MFA on every account, including legacy and service accounts. The single missing MFA on the legacy test tenant account became the entire breach. Conditional access policies that require MFA on every interactive sign-in, with break-glass accounts isolated and monitored, eliminate this entire entry path.

Tenant-to-tenant trust boundary failure analysis matters. The OAuth application's permissions reached the corporate tenant from the test tenant. Reviewing trust boundaries between tenants, applications, and resources, including reviewing app registrations and consents from a tenant security posture management tool, surfaces this class of misconfiguration.

Related career roles

The cybersecurity professionals whose day-to-day work would have detected, investigated, or contained this incident.

• /cybersecurity/careers/threat-intelligence-analyst
• /cybersecurity/careers/security-architect
• /cybersecurity/careers/incident-responder

Related Decipher Files

• Storm-0558: How a Stolen Microsoft Signing Key Reached Federal Email
• SolarWinds Sunburst: How Supply Chain Compromise Bypassed Every Endpoint Defense

Frequently asked questions