{"id":55179,"date":"2024-01-27T01:34:16","date_gmt":"2024-01-27T01:34:16","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/microsoft-sheds-some-light-on-russian-email-heist-and-how-to-learn-from-redmonds-mistakes\/"},"modified":"2024-01-27T01:34:16","modified_gmt":"2024-01-27T01:34:16","slug":"microsoft-sheds-some-light-on-russian-email-heist-and-how-to-learn-from-redmonds-mistakes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-sheds-some-light-on-russian-email-heist-and-how-to-learn-from-redmonds-mistakes\/","title":{"rendered":"Microsoft sheds some light on Russian email heist \u2013 and how to learn from Redmond’s mistakes"},"content":{"rendered":"

Microsoft, a week after disclosing that Kremlin-backed spies broke into its network and stole internal emails and files from its executives and staff, has now confirmed the compromised corporate account used in the genesis of the heist didn’t even have multi-factor authentication (MFA) enabled. <\/p>\n

On Thursday, Redmond admitted<\/a> Midnight Blizzard \u2013 a Moscow-supported espionage team also known as APT29 or Cozy Bear \u2013 “utilized password spray attacks that successfully compromised a legacy, non-production test tenant account that did not have multifactor authentication (MFA) enabled.”<\/p>\n

A password-spray attack is where a miscreant tries to<\/a> log into a number of accounts using one password, then waiting a while and trying again with another password, and repeating this over and over. It’s a type of brute-force attack designed to avoid tripping monitoring systems that catch multiple failed logins to one account in a short period of time. Password spraying is more subtle, and when an account with a weak password is identified by the attackers, they can use that to start drilling into the IT estate.<\/p>\n