Microsoft: Legacy account hacked by Russian APT had no MFA

Microsoft said the legacy test tenant account hacked by Russian nation-state threat actors this month did not have MFA enabled.

The company disclosed this information via a Thursday-night blog post titled "Midnight Blizzard: Guidance for responders on nation-state attack." Although the primary purpose of the post is to assist defenders, it also offers new insight into the attack disclosed by Microsoft last Friday.

A Russian state-affiliated threat actor known as Midnight Blizzard -- also tracked as Nobelium, Cozy Bear and APT29 -- breached Microsoft's corporate network via password spraying and accessed "a very small percentage of Microsoft corporate email accounts," including a number belonging to senior leadership. According to the initial disclosure, the account compromised was a legacy, non-production test tenant account that threat actors accessed starting in November 2023 before elevating privileges. Microsoft discovered the attack on Jan. 12.

Midnight Blizzard, which is associated with the Russian government's Foreign Intelligence Service, is widely known as the threat actor behind the infamous 2020 supply-chain attack against SolarWinds.

In this latest blog post, Microsoft clarified that the legacy test tenant account compromised by Midnight Blizzard "did not have multifactor authentication (MFA) enabled." But the company said a similar tenant today would not be as vulnerable.

"If the same team were to deploy the legacy tenant today, mandatory Microsoft policy and workflows would ensure MFA and our active protections are enabled to comply with current policies and guidance, resulting in better protection against these sorts of attacks," the post read.

TechTarget Editorial asked Microsoft why the legacy tenant did not have MFA enabled, but the company declined to comment.

In addition to the MFA detail, the post offered additional insights surrounding Midnight Blizzard's recent activity. Microsoft said Midnight Blizzard has also been targeting other organizations -- a notable piece of information given that HPE disclosed an attack attributed to the threat actor this week.

"Using the information gained from Microsoft's investigation into Midnight Blizzard, Microsoft Threat Intelligence has identified that the same actor has been targeting other organizations and, as part of our usual notification processes, we have begun notifying these targeted organizations," Microsoft said.

Regarding tactics and techniques, the tech giant said Midnight Blizzard tailored its password spraying "to a limited number of accounts, using a low number of attempts to evade detection and avoid account blocks based on the volume of failures." Moreover, the threat actor reduced visibility further by launching attacks from a "distributed residential proxy infrastructure."

Midnight Blizzard used the initial access "to identify and compromise a legacy test OAuth application that had elevated access to the Microsoft corporate environment." Microsoft noted that Midnight Blizzard is "adept" at identifying and abusing OAuth apps for lateral movement and post-compromise activity in victim networks.

"The actor created additional malicious OAuth applications," the blog post read. "They created a new user account to grant consent in the Microsoft corporate environment to the actor controlled malicious OAuth applications. The threat actor then used the legacy test OAuth application to grant them the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes."

In last week's disclosure, Microsoft said the investigation into the breach indicated the threat actors were initially targeting email accounts looking for information related on Midnight Blizzard itself.