Adrian Johnson
TLDR:
- Microsoft discloses that the Russian hacking group, Midnight Blizzard, breached its corporate networks.
- The hackers accessed a small percentage of corporate email accounts, including those of senior leaders and employees in critical functions.
- The attack was not caused by any specific vulnerability in Microsoft’s products or services.
- The breach comes after a new SEC regulation requiring companies to report cyber incidents within four days.
Microsoft has revealed that it was targeted by a Russian hacking group called Midnight Blizzard on January 12. The group, also known as APT29 or Cozy Bear, is a state-sponsored cyberespionage group that has been linked to Russia’s SVR spy agency. While the hackers managed to access only a small percentage of Microsoft’s corporate email accounts, their targets included senior leaders and employees responsible for cybersecurity, legal, and other critical functions.
The attack involved a technique called “password spray attack,” where the hackers attempt to breach a platform by using the same compromised password against multiple related accounts. Microsoft detected and disrupted the malicious activity, blocking the hackers’ access to its systems. The company clarified that the breach was not the result of any specific vulnerability in its products or services. There is also no evidence to suggest that the hackers had access to customer environments, production systems, source code, or AI systems.
Microsoft’s disclosure of the breach comes after the US Securities and Exchange Commission (SEC) introduced a new regulation requiring publicly traded companies to report cyber incidents within four business days of discovery. The regulation also mandates the disclosure of the breach’s time, scope, and nature to the government. As Microsoft products are widely used across the US government and other sectors, the breach has raised concerns about the security practices of the company.
This is not the first time Microsoft has faced cybersecurity challenges. In the past, Chinese hackers stole emails from senior US State Department officials, leading to criticism of Microsoft’s security practices. However, the company remains committed to addressing the ongoing risk posed by well-resourced nation-state threat actors like Midnight Blizzard. As cybersecurity threats continue to evolve, organizations need to remain vigilant and proactive in their defenses against such attacks.
