Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets

Microsoft on Friday unveiled that the Kremlin-backed risk actor identified as Midnight Blizzard (aka APT29 or Cozy Bear) managed to attain entry to some of its source code repositories and interior systems following a hack that arrived to gentle in January 2024.

“In new months, we have found evidence that Midnight Blizzard is utilizing facts originally exfiltrated from our corporate email techniques to gain, or endeavor to acquire, unauthorized obtain,” the tech big stated.

“This has included obtain to some of the company’s resource code repositories and inside techniques. To day we have discovered no proof that Microsoft-hosted customer-experiencing systems have been compromised.”

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Redmond, which is continuing to look into the extent of the breach, stated the Russian state-sponsored threat actor is making an attempt to leverage the various kinds of secrets and techniques it uncovered, which include these that were shared between prospects and Microsoft in email.

It, even so, did not disclose what these secrets and techniques have been or the scale of the compromise, even though it said it has directly attained out to impacted customers. It’s not apparent what resource code was accessed.

Stating that it has enhanced in its security investments, Microsoft further observed that the adversary ramped up its password spray attacks by as much as 10-fold in February, compared to the “now massive quantity” noticed in January.

“Midnight Blizzard’s ongoing attack is characterized by a sustained, substantial motivation of the threat actor’s methods, coordination, and emphasis,” it mentioned.

“It may well be making use of the data it has obtained to accumulate a photograph of locations to attack and enhance its means to do so. This reflects what has grow to be more broadly an unprecedented world-wide risk landscape, particularly in terms of sophisticated country-point out attacks.”

The Microsoft breach is mentioned to have taken put in November 2023, with Midnight Blizzard using a password spray attack to successfully infiltrate a legacy, non-manufacturing examination tenant account that did not have multi-factor authentication (MFA) enabled.

The tech large, in late January, discovered that APT29 experienced targeted other businesses by taking gain of a assorted established of original accessibility techniques ranging from stolen qualifications to offer chain attacks.

Midnight Blizzard is considered section of Russia’s Foreign Intelligence Support (SVR). Active considering the fact that at the very least 2008, the menace actor is one particular of the most prolific and advanced hacking teams, compromising high-profile targets such as SolarWinds.

Identified this report attention-grabbing? Stick to us on Twitter  and LinkedIn to study more distinctive content we publish.