Hackers have recently breached Microsoft, but not for the usual corporate information or customer data. No, this time they had a different target in mind – themselves. In a surprising turn of events, the hacking group known as Midnight Blizzard, believed to be sponsored by the Russian government, targeted email accounts of Microsoft’s senior leadership team and employees in cybersecurity, legal, and other functions.
“The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself,” Microsoft disclosed.
Their methods were a “password spray attack”, using brute force to gain access to a legacy account, and then utilizing its permissions to access a small percentage of corporate email accounts. Microsoft has not divulged the exact number of accounts breached or the extent of information stolen.
The company has stated that the hackers were after one thing – to find out what Microsoft knows about them. This raises questions about the information that Microsoft possesses and the role it plays in the world of cyber espionage.
Microsoft has taken this incident as an opportunity to address its security measures and make necessary changes. They plan to apply their current standards to legacy systems and internal business processes, even if it causes disruption. According to the company, this is just the first step in a series of actions they will be taking to prioritize security.
If you have any information about this hack, Microsoft encourages you to contact them. TechCrunch has also provided secure channels for individuals to share their insights.
Do you have more information about this hack? Contact us. From a non-work device, you can reach out to Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382 or via Telegram, Keybase, and Wire @lorenzofb, or email firstname.lastname@example.org. You can also contact TechCrunch via SecureDrop.