Microsoft confirms Russian spies stole source code, accessed internal systems

Microsoft disclosed that Russian-linked APT Midnight Blizzard (Cozy Bear/APT29) conducted an ongoing intrusion beginning in November that exfiltrated corporate emails from executives and sensitive teams, and has since used that data to gain access to some source code repositories and internal systems; the attackers have increased password-spray activity and continue attempts to access additional accounts, while Microsoft investigates and notifies affected customers.