Microsoft says 'Russian state-sponsored' hackers gained access to 'a very small percentage of Microsoft corporate email accounts'

SoftwareSecurityMicrosoft says ‘Russian state-sponsored’ hackers gained access to ‘a very small percentage of Microsoft corporate email accounts’When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

(Image credit: Getty Images)

Russian flag displayed on a laptop screen and binary code code displayed on a screen are seen in this multiple exposure illustration photo taken in Krakow, Poland on February 16, 2022. (Photo illustration by Jakub Porzycki/NurPhoto via Getty Images)

“Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents,” Microsoft wrote.

“The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed.”

Microsoft said it detected the attack on January 12. It didn’t elaborate on what information Midnight Blizzard/Nobelium may have been looking for, but there’s a long history between the two. In 2021, following the SolarWinds hack, Microsoft posted afour-part blog/video series on the group that “pulls the curtain back on the NOBELUM incident and how world-class threat hunters from Microsoft and around the industry came together to take on the most sophisticated nation-state attack in history.”

Microsoft has also taken an active role incombatting Russian cyber-attacks against Ukraine.

YouTubeWatch On

YouTube

“Password spraying” is a brute force attack in which a hacker hits known valid usernames with common passwords in the hope that someone got lazy and used something like “1234.” Automated systems are often used to roll through a large number of passwords in a relatively short amount of time, and it’s tough to defend against because it doesn’t exploit vulnerabilities in systems, but in users.

From the website of online security companyLogin Radius:

The biggest gaming news, reviews and hardware deals

Hackers can go after specific users and cycles using as many passwords as possible from either a dictionary or an edited list of common passwords. Password spraying is not a targeted attack, it is just one malicious actor acquiring a list of email accounts or gaining access to an active directory and attempting to sign in to all the accounts using a list of the most likely, popular, or common passwords until they get a hit.

The key takeaway from password spraying is that user accounts with old or common passwords form the weak link hackers can exploit to gain access to the network. Unfortunately, password spraying attacks are frequently successful because so many account users fail to follow the best password protection practices or choose convenience over security.

Microsoft said essentially the same thing, noting that the attack “was not the result of a vulnerability in Microsoft products or services.” There’s currently no evidence that hackers gained access to “customer environments, production systems, source code, or AI systems,” and it will notify customers if and when any further action is required.

Even if that’s the case, the hack will have an impact: Microsoft said the proliferation of state-sponsored hackers has forced it to reassess “the balance we need to strike between security and business risk,” and that it will immediately apply “current security standards to Microsoft-owned legacy systems and internal business processes.”

“This will likely cause some level of disruption while we adapt to this new reality, but this is a necessary step, and only the first of several we will be taking to embrace this philosophy.”

More about security

A still from a YouTube video of Senator Mark Warner speaking

Telecoms hack on US government officials is ‘worst in nations history’ and ‘the barn door is still wide open’ says senator

HDMI cable

LatestThe 11 big FPS games of 2025See more latest►

Latest

The 11 big FPS games of 2025

Doom: The Dark Ages screnshot

The 11 big FPS games of 2025

See more latest►

Most PopularThe Sims begins its 25th anniversary celebration next week with a Behind The Sims episode of news and announcementsPath of Exile 2 numberlord spends 16 straight days killing rare monsters to prove that a stat that makes loot better makes better lootPalestinian developer raises more than $200,000 to make Dreams on a Pillow, a game about the horrors of the 1948 NakbaPiranha Games will lay off employees after Mechwarrior 5: Clans ‘performed below projections’Marvel Rivals’ latest update quietly killed the game’s burgeoning mod sceneSorry everyone, Minecraft 2 is cancelled, and it might be our faultTeam Fortress 2 just had the single biggest trade in its history, with ‘the absolute best hat you can get’ going for around $40KIs the new RTX 5070 really as fast as Nvidia’s previous flagship RTX 4090 GPU? Turns out the answer is yes. Kinda.Elden Ring: Nightreign is getting a closed network test, and I’m totally not fuming because PC players aren’t invited to the party, or anythingIf you’re a content creator and gamer looking for a CPU upgrade, this Ryzen 9 9900X deal will get you $90 offAMD is now reportedly making all-American Ryzen 9000 CPU dies at TSMC’s Arizona fab

Most Popular

The Sims begins its 25th anniversary celebration next week with a Behind The Sims episode of news and announcements

Path of Exile 2 numberlord spends 16 straight days killing rare monsters to prove that a stat that makes loot better makes better loot

Palestinian developer raises more than $200,000 to make Dreams on a Pillow, a game about the horrors of the 1948 Nakba

Piranha Games will lay off employees after Mechwarrior 5: Clans ‘performed below projections’

Marvel Rivals’ latest update quietly killed the game’s burgeoning mod scene

Sorry everyone, Minecraft 2 is cancelled, and it might be our fault

Team Fortress 2 just had the single biggest trade in its history, with ‘the absolute best hat you can get’ going for around $40K

Is the new RTX 5070 really as fast as Nvidia’s previous flagship RTX 4090 GPU? Turns out the answer is yes. Kinda.

Elden Ring: Nightreign is getting a closed network test, and I’m totally not fuming because PC players aren’t invited to the party, or anything

If you’re a content creator and gamer looking for a CPU upgrade, this Ryzen 9 9900X deal will get you $90 off

AMD is now reportedly making all-American Ryzen 9000 CPU dies at TSMC’s Arizona fab

HARDWARE BUYING GUIDESLATEST GAME REVIEWS1Best Steam Deck accessories in Australia for 2025: Our favorite docks, powerbanks and gamepads2Best graphics card for laptops: the mobile GPUs I’d want in my next gaming laptop3Best mini PCs in 2025: The compact computers I love the most4Best 14-inch gaming laptop: The top compact gaming laptops I’ve held in these hands5Best Mini-ITX motherboards in 2025: My pick from all the mini mobo marvels I’ve tested1Thank Goodness You’re Here! review2Shiren the Wanderer: The Mystery Dungeon of Serpentcoil Island review3WD Black SN850X 8 TB NVMe SSD review4Ikea Utespelare desk review5Asus ROG Harpe Ace Mini wireless mouse review

HARDWARE BUYING GUIDESLATEST GAME REVIEWS

1Best Steam Deck accessories in Australia for 2025: Our favorite docks, powerbanks and gamepads

A bunch of the best Steam Deck accessories on a blue background.

1Best Steam Deck accessories in Australia for 2025: Our favorite docks, powerbanks and gamepads

Best Steam Deck accessories in Australia for 2025: Our favorite docks, powerbanks and gamepads

2Best graphics card for laptops: the mobile GPUs I’d want in my next gaming laptop

Best graphics card for laptops: the mobile GPUs I’d want in my next gaming laptop

3Best mini PCs in 2025: The compact computers I love the most

Best mini PCs in 2025: The compact computers I love the most

4Best 14-inch gaming laptop: The top compact gaming laptops I’ve held in these hands

Best 14-inch gaming laptop: The top compact gaming laptops I’ve held in these hands

5Best Mini-ITX motherboards in 2025: My pick from all the mini mobo marvels I’ve tested

Best Mini-ITX motherboards in 2025: My pick from all the mini mobo marvels I’ve tested

1Thank Goodness You’re Here! review

Thank Goodness You’re Here review

1Thank Goodness You’re Here! review

Thank Goodness You’re Here! review

2Shiren the Wanderer: The Mystery Dungeon of Serpentcoil Island review

Shiren the Wanderer: The Mystery Dungeon of Serpentcoil Island review

3WD Black SN850X 8 TB NVMe SSD review

WD Black SN850X 8 TB NVMe SSD review

4Ikea Utespelare desk review

Ikea Utespelare desk review

5Asus ROG Harpe Ace Mini wireless mouse review

Asus ROG Harpe Ace Mini wireless mouse review

The biggest gaming news, reviews and hardware deals#

The biggest gaming news, reviews and hardware deals