Microsoft Shares New Guidance in Wake of 'Midnight Blizzard' Cyberattack

Microsoft disclosed that the nation-state group Midnight Blizzard (Cozy Bear/SVR) accessed Microsoft corporate email by password-spraying a legacy test account, leveraging a compromised legacy OAuth app and creating malicious OAuth applications to obtain non-expiring tokens and exfiltrate emails and attachments; Microsoft released guidance to detect and mitigate such OAuth abuse by auditing high-privilege and non-human identities, reviewing ApplicationImpersonation privileges, and using anomaly detection and conditional access controls.