Another day, another high-profile data breach. This time, the tech giant Microsoft finds itself cleaning up the aftermath of an attack reportedly carried out by Russian state-sponsored hackers. It isn’t the best way to start the new year, but unfortunately, data breaches have become all too common in today’s world. Let’s delve into the details of this latest breach and what its implications could be.

What Happened, and How?

On January 12th, 2024, hackers gained access to Microsoft’s corporate systems using a technique known as ‘password spraying’.

A password spray attack is a type of cyberattack where hackers use a list of commonly used or stolen passwords to attempt access to multiple accounts. This method differs from traditional brute force attacks, which try every possible combination for a single account until the correct password is found.

It has several strategic advantages for hackers, including reducing the risk of being detected by automated security systems and avoiding account lockouts. In this case, it allowed attackers to gain access to an unspecified amount of Microsoft’s internal company data.

The covert campaign is believed to have begun in November 2023 and was ultimately discovered in mid-January 2024. Microsoft immediately addressed the breach upon its discovery during a routine threat investigation and responded decisively by securing the compromised accounts.

This comes after several notable track record infractions against the company over recent years, most recently a 2023 incident in which tens of thousands of emails belonging to senior U.S. State Department officials were stolen by Chinese hackers.

The Usual Suspects

Microsoft says it believes this recent security incident is the work of ‘Midnight Blizzard’, a Russian State-sponsored cybercrime group with a long history of targeting American organizations. You may have also heard of them under the names ‘APT29’, ‘Nobelium’, or ‘Cozy Bear’.

In 2016, they were linked to the infamous data breach against the Democratic National Committee (DNC) during the U.S. presidential election. That incident had massive repercussions during a time of heightened political tensions in the United States and eventually resulted in the indictment of 12 Russian intelligence officers by a national Grand Jury.

Lessons weren’t learned, though; Midnight Blizzard is behind several other large hacks that have taken place over recent years, including multiple attempted thefts of vaccine and treatment data during the COVID-19 pandemic. There were multiple victims in the crosshairs of this sophisticated and dangerous actor, including organizations in the United States, United Kingdom, and Canada.

So, who are these guys, exactly?

Midnight Blizzard is an open secret among Russia’s intelligence community. It is believed to be a unit within the Russian Federal Security Service (FSB) that focuses on cyber espionage and influence operations. They have been active since at least 2014 and are known for their advanced hacking techniques, including using custom malware and zero-day vulnerabilities to gain access to their targets’ systems.

Their primary goal is to collect intelligence for the Russian government, but they have also been known to engage in cyber-attacks that serve political agendas. Victims range from government agencies and military organizations to private companies and research institutions. Adversaries like Russia are also increasingly focusing their efforts on disruptions and disinformation campaigns to sow chaos and undermine trust in democratic institutions. Physical infrastructure is another valuable target; another Russian-sponsored group, Sandworm, has been linked to a cyber-attack that paralyzed Ukraine’s power grid in 2015.

The Damages

This particular attack seems to have been motivated by the hackers’ desire for information rather than any specific goal of causing harm or disruption. Microsoft said in a release that there is no evidence Midnight Blizzard ever acquired access to customer-facing environments, production systems, source code, or AI systems.

However, hackers did access a very small percentage of email accounts belonging to the company’s senior leadership, legal, and cybersecurity teams, as well as swipe some internal documents.

Even so, the data breach is a timely reminder for large companies as cybercrime continues to rise at a record pace both in the United States and around the world. Society is only becoming more digital by the day, and those who fail to insulate their customers against risks simply won’t survive. Microsoft did a good thing by stringently monitoring its networks in case of an incident like this. It was in a prime position to actively investigate and respond upon discovering Midnight Blizzard’s access to internal systems. Sometimes, organizations fail to notice compromises for months or even years before taking action and ultimately put more data and people at risk as a result.

It’s further worth noting that this specific attack is not thought to be the result of a vulnerability in Microsoft’s products or services – the company is simply a prime target for its solutions’ widespread use in government and private sectors.

The SEC’s Latest Law Comes into Play

Amid a chronic rise in cyber risk across the board, the United States Securities and Exchange Commission (SEC) has implemented a new law requiring publicly traded companies to disclose incidents within four days of being discovered. It argues that consumers and investors have the right to know if their data is at risk and that timely disclosure can help mitigate potential damage. Before this law, there was no obligation for companies to report cyber incidents unless they posed an immediate threat. They now have to fully disclose the time, scope, and nature of breaches to the government and the public, as did Microsoft.

Microsoft reported this data breach within the four-day timeframe prescribed by the SEC. The Russian Embassy in Washington and the Ministry of Foreign Affairs did not immediately respond to requests for public comment.

Midnight Blizzard’s attack on Microsoft is just the latest in a string of cyber-attacks that have highlighted the growing threat of state-sponsored actors. With more countries investing in offensive cyber capabilities, we’re seeing world powers shift to a new kind of warfare with 1s and 0s as their weapons. In this evolving landscape, it’s crucial to fortify our digital defenses. Consider Teradact as your ally in navigating these cyber challenges and safeguarding your digital assets.