Microsoft breach allowed Russian spies to steal emails from US government

CISA issued Emergency Directive ED 24-02 after Russian-linked APT Midnight Blizzard (Cozy Bear) breached Microsoft’s corporate email, exfiltrating email correspondence — including authentication details — between Microsoft and federal agencies; agencies must analyze exfiltrated emails, reset compromised credentials, secure privileged Azure authentication, and report remediation status to CISA on an expedited schedule.