The blog post and regulatory filing from Microsoft revealed that a Russian intelligence-backed hacking group gained access to the emails of some of the company’s top executives starting in late November. The intrusion was discovered a week ago, and Microsoft is still investigating. The hackers focused on searching through corporate email accounts for information related to the group known as Midnight Blizzard, looking through emails from senior leadership and employees in cybersecurity, legal, and other departments, and taking some emails and attachments. The Russian Foreign Intelligence Service has been running the hacking group since at least 2008, and the group has been behind high-profile hacks in the past. Previous targets have included the Democratic National Committee in 2015 and the tech supplier SolarWinds, leading to access to systems at the State Department, Department of Homeland Security, and parts of the Pentagon in 2020. Microsoft called this incident “the most sophisticated nation-state cyberattack in history.” The hackers used a relatively basic tactic called password spraying to gain access to the corporate email accounts through an old account for a testing system. Microsoft stated that there is no evidence that the hackers had access to customer environments, production systems, source code, or A.I. systems. The company has notified law enforcement and is working with them. Microsoft, which provides technology to many Western governments, has long been a target of nation-state hacking, with Chinese hackers breaching the company’s systems and gaining access to the email accounts of government officials last year.
