Midnight Blizzard: Guidance for responders on nation-state attack

*Executive summary:* Microsoft detected and investigated a nation-state intrusion by the Russian-linked actor Midnight Blizzard (NOBELIUM) that used targeted password-spray attacks against a legacy non-production tenant lacking MFA, created and abused OAuth applications (including granting full_access_as_app and ApplicationImpersonation) to access Exchange Online via Exchange Web Services for email collection, and routed activity through residential proxy infrastructure; the report details observed techniques, detection/hunting queries, Entra/Defender/Sentinel alerts, and recommended defenses to protect and remediate similar compromises.