Midnight Blizzard Attack on Microsoft: Timeline, Causes & Lessons
Quick answer: In January 2024, Microsoft disclosed that Midnight Blizzard ( a Russian state-sponsored hacking group also tracked as APT29, Cozy Bear, or Nobelium) broke into its corporate systems using a simple password spray attack on a test account. From that one weak account, the hackers worked their way up to reading the emails of Microsoft’s senior leadership and, months later, Microsoft admitted the same group had also touched some of its source code. The scariest part isn’t the sophistication. It’s how basic the starting point was.
If you’ve ever wondered how a company as security-obsessed as Microsoft could get breached, this one is worth understanding closely, because the mistakes involved are the same ones ordinary users and small businesses make every day.
Who Is Midnight Blizzard?
Midnight Blizzard is the name Microsoft uses for a hacking group that Western governments say works for Russia’s Foreign Intelligence Service (SVR). You’ll also see it called:
- APT29
- Cozy Bear
- Nobelium (Microsoft’s older name for the group)
- UNC2452
This isn’t a new player. The same group is linked to the 2016 hack of the Democratic National Committee and, more infamously, the 2020 SolarWinds attack, where hackers slipped malicious code into a widely used IT management tool and used it to spy on multiple U.S. government agencies for months before anyone noticed.
If you want to understand how supply-chain attacks like SolarWinds work in more depth, a good primer is “Sandworm” by Andy Greenberg, available on Amazon, which covers state-sponsored hacking groups, including Russia’s.
Midnight Blizzard’s targets are usually governments, diplomats, NGOs, and IT service providers, mostly in the US and Europe, and its goal is almost always espionage, not ransomware or financial theft.
That’s an important distinction: this group plays the long game, quietly collecting intelligence rather than making noise.
Timeline: How the Microsoft Attack Unfolded
| Date | What Happened |
|---|---|
| Late November 2023 | Midnight Blizzard uses a password spray attack to break into an old, unused “legacy” test account at Microsoft that didn’t have multi-factor authentication (MFA) turned on. |
| January 12, 2024 | Microsoft’s security team detects suspicious activity on its corporate email systems. |
| January 19, 2024 | Microsoft publicly discloses the breach and files an SEC 8-K report, as required for material cybersecurity incidents. |
| February 2024 | Microsoft notices password spray attempts against it have jumped roughly 10x compared to January. |
| March 8, 2024 | Microsoft admits the hackers used information stolen from emails to access some source code repositories and internal systems. |
| October 2024 | Microsoft warns that Midnight Blizzard is running a large-scale spear-phishing campaign using malicious RDP configuration files sent to thousands of targets. |
| 2025–2026 | Microsoft and third parties (including HPE, which disclosed a related SEC filing) report continued Midnight Blizzard activity, including a 2026 campaign called CaptiveCrunch targeting travellers through compromised hotel Wi-Fi login portals. |
The group hasn’t slowed down; if anything, its targeting has broadened to hit new sectors using new tricks, which is why this story is still relevant well beyond its original 2024 headlines.
Related: Wi-Fi Router Buying Guide for India
How the Attack Actually Worked, Step by Step
This is the part most coverage glosses over, but it’s the most useful bit if you want to actually learn from it.
1. A password spray attack on a forgotten test account
A password spray attack is different from the “brute force” attacks most people picture. Instead of hammering one account with thousands of password guesses (which trips alarms fast), the attacker tries a small number of common passwords across many accounts.
It’s slower and quieter, and it’s specifically designed to fly under the radar of systems that lock accounts after a few failed attempts.
Midnight Blizzard used this technique against a legacy, non-production test tenant account, essentially an old testing environment that Microsoft’s own team had left without multi-factor authentication. It wasn’t a flaw in Windows, Office, or Azure. It was a forgotten door.
2. Turning one weak account into real access
Once inside the test tenant, the attackers didn’t stop there. They found an old OAuth application with elevated permissions sitting in that environment and hijacked it. OAuth is the technology that lets one app access data in another on your behalf (think “Sign in with Google”; same idea). The hackers:
- Created new malicious OAuth applications of their own
- Set up a new user account to grant those apps permission inside Microsoft’s real corporate environment
- Used the compromised legacy app to grant themselves the
full_access_as_approle in Exchange Online, which meant they could read any mailbox they wanted
3. Reading emails through Exchange Web Services
With that permission in hand, the attackers used Exchange Web Services (EWS) ( a legitimate Microsoft API) to systematically pull emails from a small number of very high-value accounts, including senior leadership and staff in the legal and cybersecurity teams.
4. Hiding behind residential proxies
To avoid detection, the hackers routed their traffic through residential proxy networks, essentially using the IP addresses of ordinary home internet connections around the world. Since those IPs look like everyday users, they don’t trigger the usual “suspicious location” alerts that security tools rely on.
5. The fallout widens
Months later, Microsoft confirmed the stolen emails contained “secrets” ( credentials and configuration details some customers had shared with Microsoft via email) which the hackers then tried to use to break into other organisations.
HPE later disclosed a related incident tracing back to mailbox access dating to mid-2023, suggesting the campaign against Microsoft-adjacent targets was broader and longer-running than first understood.
Why a Company Like Microsoft Got Breached This Way
It’s tempting to assume a $3-trillion company would have zero weak links, but that’s exactly the lesson here: security is only as strong as your most forgotten corner.
Microsoft itself admitted as much, stating that if the same test tenant were deployed today, current policy would have forced MFA on it automatically. In other words, this was a gap in process, not in Microsoft’s products.
Common Mistakes This Attack Exposed:
- Leaving old “test” or “non-production” accounts active with no expiry
- Not enforcing MFA uniformly across every account, including internal ones
- Granting OAuth apps more permission than they actually need
- Assuming internal/legacy systems are low-risk because they’re not customer-facing
Related: How to Protect Your Bank Account From Hackers
Myth vs Fact
Myth: Microsoft’s products (Windows, Office 365, Azure) had a security flaw that let hackers in.
Fact: No vulnerability in a shipped Microsoft product was exploited. This was a breach of Microsoft’s internal corporate systems through weak account hygiene, not a bug customers need to patch.
Myth: This was a hugely sophisticated, unstoppable “supergenius hacker” attack.
Fact: The entry point ( a password spray against an account without MFA) is one of the oldest, cheapest attack techniques in existence. The sophistication came after the break-in, in how the attackers escalated access.
Myth: Since Microsoft says customer data wasn’t touched, regular users have nothing to worry about.
Fact: Microsoft has repeatedly confirmed that credentials and “secrets” shared with it by other companies over email were exposed, and Midnight Blizzard used those to try breaking into additional organisations; meaning the blast radius extended well past Microsoft itself.
What This Means for You (Not Just Enterprises)
You don’t run a Fortune 500 company, but the same weak point ( passwords without MFA) is the number one way ordinary Indian users lose access to their email, banking apps, and social media too.
Checklist: Protect your own accounts from the same mistake
- Turn on multi-factor authentication (MFA) on every account that offers it: email, banking, UPI apps, social media
- Use an authenticator app (like Microsoft Authenticator or Google Authenticator) instead of SMS-based codes where possible, since SMS can be intercepted
- Delete or deactivate accounts and apps you no longer use; don’t let “test” logins sit around forever
- Review which third-party apps have access to your Google or Microsoft account, and revoke ones you don’t recognise
- Use a unique, strong password for every account; a password manager makes this painless
For an extra layer of protection that password-spray attacks can’t touch, a physical security key like the YubiKey 5 NFC (available on Amazon) lets you add hardware-based two-factor authentication to your Microsoft, Google, and other accounts in a few minutes.
Tip: If you manage a small business, the single highest-impact fix you can make today isn’t buying new security software. It’s auditing every account (including ones your team has forgotten about) and confirming MFA is switched on across the board. That’s precisely the gap that let Midnight Blizzard in.
Related: Hackers Use the AutoSpill Vulnerability to Steal Password Managers
Midnight Blizzard vs Other Well-Known Hacking Groups
| Group | Believed Origin | Known For | Primary Goal |
|---|---|---|---|
| Midnight Blizzard (APT29) | Russia (SVR) | SolarWinds, Microsoft 2024 breach, CaptiveCrunch (2026) | Espionage/intelligence gathering |
| Lazarus Group | North Korea | Sony Pictures hack, crypto exchange thefts | Financial theft, sanctions evasion |
| Fancy Bear (APT28) | Russia (GRU) | 2016 DNC hack (alongside APT29) | Political/military espionage |
| Scattered Spider | Financially motivated (various) | MGM, Caesars casino breaches | Ransomware, extortion |
Unlike ransomware crews chasing a payday, Midnight Blizzard’s pattern across a decade of attacks is patience: sitting quietly inside a network to collect intelligence rather than cause visible disruption, which is exactly why this breach went undetected from late November 2023 until January 12, 2024.
Lessons for Businesses of Any Size
- Treat every account as a potential front door – including test, legacy, and internal-only accounts. Attackers don’t care that an account is “unimportant” to you; they care that it’s unguarded.
- Enforce MFA without exceptions. Microsoft’s own postmortem points squarely at this as the fix that would have stopped the initial breach.
- Audit OAuth and third-party app permissions regularly. Over-permissioned apps are a favourite lateral-movement tool for groups like this one.
- Log everything, including internal API activity. Microsoft only caught this by reviewing Exchange Web Services logs. Visibility is what turned a quiet breach into a detected one.
- Assume nation-state attackers play a long game. This wasn’t a smash-and-grab; the group used the initial email access to hunt for further access for months afterwards.
Is Midnight Blizzard Still Active?
Yes, and this is where most articles on this topic stop short. Microsoft’s own threat intelligence team has continued flagging Midnight Blizzard activity well past the original 2024 breach:
- October 2024: A large-scale spear-phishing campaign sent malicious RDP (Remote Desktop Protocol) configuration files to thousands of targets across government, academia, and defense organizations.
- 2026: A sub-cluster of the group, tracked as Storm-2945, was observed running a campaign called CaptiveCrunch, compromising hotel Wi-Fi login (captive) portals worldwide to deliver malware and steal credentials from travellers, including through fake Microsoft sign-in pages using device-code phishing.
The throughline across all of it: credential theft and identity-based attacks, not software exploits. That’s a pattern worth remembering the next time you connect to hotel Wi-Fi or get an unexpected sign-in prompt.
Related: What Is Deepfake Technology and How Can You Spot It?
Conclusion
The Midnight Blizzard breach of Microsoft is a reminder that even the world’s largest tech companies can be undone by something as unglamorous as an old test account without MFA.
The technical escalation that followed – OAuth abuse, residential proxies, months of quiet email collection – was sophisticated, but the door those hackers walked through was ordinary.
That’s genuinely good news for the rest of us: the single biggest thing standing between your accounts and an attack like this isn’t some expensive enterprise tool; it’s turning on multi-factor authentication and cleaning up accounts you’ve stopped using.
Do that today, and you’ve already closed the same gap that let a nation-state group into Microsoft.
Frequently Asked Questions
It’s a 2024 cyberattack where the Russian state-sponsored hacking group Midnight Blizzard (APT29) broke into Microsoft’s corporate email systems using a password spray attack, eventually gaining access to senior leadership emails and, months later, some source code.
Midnight Blizzard is believed to be linked to Russia’s Foreign Intelligence Service (SVR). It’s also known as APT29, Cozy Bear, Nobelium, and UNC2452, and is the same group tied to the 2020 SolarWinds attack.
The intrusion began in late November 2023. Microsoft detected it on January 12, 2024, and publicly disclosed it on January 19, 2024.
Through a password spray attack against an old, non-production test account that didn’t have multi-factor authentication enabled.
It’s a technique where attackers try a small set of common passwords across many different accounts, rather than many passwords against one account, making it harder for security systems to detect.
Microsoft has stated it found no evidence that customer-facing systems, production environments, or customer data were compromised.
Yes. In March 2024, Microsoft confirmed the group had accessed some of its source code repositories and internal systems using information stolen from the compromised emails.
A small number of Microsoft corporate email accounts, including members of the senior leadership team and staff in the cybersecurity and legal departments.
Yes, Nobelium is Microsoft’s older name for the same threat actor now called Midnight Blizzard.
Yes. The same group carried out the 2020 SolarWinds supply chain attack, which compromised multiple US government agencies.
OAuth lets one app access data in another on a user’s behalf (like “Sign in with Google”). The attackers hijacked an old OAuth app with elevated permissions to grant themselves broad access to Microsoft’s email systems.
The attackers used residential proxy networks to route traffic through ordinary home IP addresses, which don’t trigger the location-based alerts security systems typically rely on.
Yes. Microsoft has reported ongoing Midnight Blizzard activity, including a 2024 spear-phishing campaign using RDP files and a 2026 campaign called CaptiveCrunch targeting travellers via hacked hotel Wi-Fi portals.
Yes. HPE disclosed in an SEC filing that a threat actor believed to be Midnight Blizzard had also accessed its systems, with mailbox access dating back to May 2023.
Turn on multi-factor authentication, avoid reusing passwords, regularly review which third-party apps have access to your account, and consider a hardware security key for extra protection.
Midnight Blizzard focuses on quiet, long-term espionage and intelligence gathering, whereas ransomware groups typically aim for fast financial extortion by locking up systems and demanding payment.
Public reporting has not confirmed any regulatory fine specifically tied to this incident; Microsoft’s disclosures were made under SEC rules requiring reporting of material cybersecurity incidents.
That even unused “test” or legacy accounts need multi-factor authentication and regular audits, since attackers specifically look for exactly these kinds of forgotten weak points.
While the direct breach targeted Microsoft’s corporate systems, the same techniques (password spraying and OAuth abuse) are commonly used against businesses and individuals everywhere, including in India, making the lessons directly applicable.
Microsoft publishes ongoing updates through its Microsoft Security Response Centre (MSRC) blog and Microsoft Threat Intelligence blog.
We hope you are interested in our articles and consider following our Facebook, Instagram, and Twitter pages for regular updates.
Also, share this article with your friends and relatives. Bookmark this page for future reference.
Subscribe to our free newsletter to get similar articles and regular updates directly in your Email Inbox.
Subscribe to be the first to learn about new information
Disclosure: If you follow our links to a retailer’s website and make a purchase, we will get an affiliate commission on some, but not all, of the items or services we promote. This will cause no price change for you.
You May Be Interested to Read:
- Hackers Use the AutoSpill Vulnerability to Steal Password Managers: IIIT Hyderabad
- How to Hack Your Bank Account by Hackers and How It Can Be Protected?
- Users of Apple and Samsung Should Be Cautious; Warning from CERT-In
- Mesh Wi-Fi Guide for India
- Chinese Malware, ‘Horse Shell’, Is a Threat to Home and Office Routers
