Microsoft says Russian hackers also targeted other organizations

Microsoft disclosed that the Russian-linked group Midnight Blizzard (APT29) conducted a targeted espionage campaign beginning in late November, using password-spray attacks against legacy systems lacking MFA and distributed residential proxies to evade detection; the attackers accessed and exfiltrated some corporate emails and attachments from a small percentage of mailboxes—targeting senior executives and security/legal staff—and Microsoft has notified other targeted organizations, with HPE later reporting related mailbox and SharePoint data exfiltration.