Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets

Microsoft on Friday exposed that the Kremlin-backed danger actor acknowledged as Midnight Blizzard (aka APT29 or Cozy Bear) managed to attain access to some of its resource code repositories and inner systems adhering to a hack that came to mild in January 2024.

“In recent weeks, we have noticed proof that Midnight Blizzard is working with information and facts to begin with exfiltrated from our company email techniques to gain, or try to achieve, unauthorized access,” the tech giant reported.

“This has provided obtain to some of the company’s source code repositories and internal units. To day we have uncovered no evidence that Microsoft-hosted shopper-struggling with devices have been compromised.”

Redmond, which is continuing to investigate the extent of the breach, said the Russian condition-sponsored threat actor is making an attempt to leverage the different forms of techniques it identified, which includes those that had been shared involving customers and Microsoft in email.

It, however, did not disclose what these tricks were being or the scale of the compromise, though it reported it has directly arrived at out to impacted shoppers. It can be not distinct what supply code was accessed.

Stating that it has increased in its security investments, Microsoft additional observed that the adversary ramped up its password spray attacks by as much as 10-fold in February, when compared to the “now substantial quantity” observed in January.

“Midnight Blizzard’s ongoing attack is characterised by a sustained, substantial commitment of the risk actor’s assets, coordination, and concentration,” it stated.

“It may be making use of the data it has attained to accumulate a image of parts to attack and enrich its skill to do so. This demonstrates what has become extra broadly an unparalleled worldwide risk landscape, primarily in phrases of complex nation-condition attacks.”

The Microsoft breach is mentioned to have taken position in November 2023, with Midnight Blizzard using a password spray attack to efficiently infiltrate a legacy, non-manufacturing examination tenant account that did not have multi-issue authentication (MFA) enabled.

The tech big, in late January, revealed that APT29 had qualified other companies by taking benefit of a assorted established of initial entry methods ranging from stolen credentials to supply chain attacks.

Midnight Blizzard is thought of part of Russia’s International Intelligence Provider (SVR). Active due to the fact at the very least 2008, the threat actor is one particular of the most prolific and refined hacking groups, compromising large-profile targets such as SolarWinds.

Located this posting fascinating? Observe us on Twitter  and LinkedIn to browse a lot more exceptional information we article.

Some parts of this article are sourced from:
thehackernews.com