According to Microsoft's MSRC blog on 19 January 2024, Midnight Blizzard (also known as Nobelium) used a password spray attack beginning in late November 2023 to compromise a legacy non-production Microsoft test tenant account that lacked MFA, gained a foothold, and then used that account's permissions to access a very small percentage of Microsoft corporate email accounts and exfiltrate some emails and attached documents. Microsoft's security team detected the nation-state attack on corporate systems on 12 January 2024. Microsoft stated the attack was not the result of a vulnerability in its products or services, and reported no evidence of access to customer environments, production systems, source code, or AI systems.
If you want the prevention angle, read the related article on mfa2point0.com.
FAQ
How did Midnight Blizzard get initial access at Microsoft?
Midnight Blizzard got initial access by password-spraying a legacy non-production Microsoft test tenant account that did not have MFA. According to Microsoft's MSRC blog on 19 January 2024, the Russian state-sponsored actor also known as Nobelium began that spray in late November 2023 and gained a foothold with the compromised account. Public reporting does not establish the exact password, spray volume, or tooling used against that account.
Did the attackers bypass MFA on the sprayed account?
No. The legacy test tenant account Midnight Blizzard sprayed had no MFA enrolled, so there was no second factor to complete or defeat at login. The spray succeeded against a password-only authentication surface. After the actor signed in as that account, corporate mailbox reach used the account's existing permissions, which is a post-authentication access problem rather than another login challenge on the same path.
What did Midnight Blizzard access after the foothold?
After authenticating as the compromised legacy account, Midnight Blizzard used that account's permissions to access a very small percentage of Microsoft corporate email accounts, including members of senior leadership and employees in cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. Public reporting does not establish exact mailbox or document counts. Microsoft reported no evidence the actor reached customer environments, production systems, source code, or AI systems.
Was the Microsoft intrusion a product or service vulnerability?
No. Microsoft stated the attack was not the result of a vulnerability in Microsoft products or services. The documented foothold was a legacy non-production test tenant account left without MFA and exposed to password spray, not a flaw in the login product itself.
Would MFA on that test tenant account have stopped this path?
MFA on that legacy non-production test tenant account would have removed the password-only spray surface Midnight Blizzard used for initial access. Once a valid session already existed under the sprayed account, login MFA could not undo mailbox rights granted by that account's permissions. Closing the no-MFA spray path is the prevention claim for this intrusion. A fix for that class of workforce identity gap exists; the companion post covers the prevention side.
