Microsoft says state-sponsored Russian hacking group accessed email accounts of senior leaders

A Russian hacking group gained access to some email accounts of Microsoft senior leaders, the software giant disclosed in a regulatory filing Friday afternoon.

A Russian hacking group gained access to some email accounts of Microsoft senior leaders, the software giant disclosed in a regulatory filing Friday afternoon. “The Microsoft security team detected a nation-state attack on our corporate systems on January 12, 2024, and immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access,” the Microsoft Security Response Center said in a blog post. “Microsoft has identified the threat actor as Midnight Blizzard, the Russian state-sponsored actor also known as Nobelium.” Hackers were able to gain access to “a very small percentage of Microsoft corporate email accounts,” the blog post added, including accounts belonging to members of its senior leadership team and employees in its cybersecurity and legal departments. The company said that hackers were able to exfiltrate some emails and attached documents, though the preliminary investigation indicates that the attackers seemed to be seeking information related to Midnight Blizzard itself. Microsoft said it is in the process of notifying employees whose email was accessed. There is currently no evidence that the hackers had any access to customer environments or AI systems, Microsoft said. The attack began in late November 2023, the company said, and hackers gained an initial foothold using a so-called “password spray attack.” Password spraying refers to the attempt to access a large number of accounts using commonly known passwords.