Russian hackers stole Microsoft corporate emails in month-long breach

Microsoft disclosed that Russian state-sponsored group Nobelium (aka Midnight Blizzard / APT29) breached a legacy non-production test account in November 2023 using a password-spray attack, accessed a small percentage of corporate email accounts (including leadership and cybersecurity/legal staff), and exfiltrated emails and attachments; the company attributes the breach to weak account configuration and lack of MFA rather than a product vulnerability and is investigating and notifying affected employees.