Microsoft Midnight Blizzard Breach 2024: How a Forgotten Test Tenant and an OAuth App Opened Executive Mailboxes

In January 2024, Microsoft disclosed that Midnight Blizzard, the Russian state actor also known as Nobelium and APT29, had been inside its corporate email since late November 2023. The intruder started with a password spray against a legacy, non-production test tenant account that did not have multi-factor authentication enabled. From there, Microsoft says, the actor compromised a legacy test OAuth application with elevated access to the corporate environment, created its own malicious OAuth applications and granted itself the Exchange Online full_access_as_app role. That application permission let it read mailboxes belonging to senior leaders and to staff in cybersecurity, legal and other functions. Microsoft later said the actor used stolen information to target source code repositories, internal systems and secrets customers had shared by email. A forgotten test identity and an over-privileged app registration bypassed everything built around human users.

At a glance

What happened

On Friday 19 January 2024, Microsoft's Security Response Center (MSRC) announced that its security team had detected a nation-state attack on its corporate systems on 12 January. In the same day's SEC Form 8-K filing, Microsoft said that "beginning in late November 2023, a nation-state associated threat actor had gained access to and exfiltrated information from a very small percentage of employee email accounts including members of our senior leadership team and employees in our cybersecurity, legal, and other functions." The filing added that Microsoft was able to remove the actor's access to the email accounts "on or about January 13, 2024."

MSRC explained that the actor "used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold". The intruder initially searched mailboxes "for information related to Midnight Blizzard itself". Microsoft stressed that "The attack was not the result of a vulnerability in Microsoft products or services."

On 25 January 2024, Microsoft Threat Intelligence published guidance for responders with more detail on the method. The password spray was deliberately quiet: the actor targeted "a limited number of accounts, using a low number of attempts to evade detection and avoid account blocks," and routed traffic through residential proxy networks, using IP addresses also used by legitimate users.

The critical step came next. According to Microsoft, "Midnight Blizzard leveraged their initial access to identify and compromise a legacy test OAuth application that had elevated access to the Microsoft corporate environment." The actor then "created additional malicious OAuth applications" and "created a new user account to grant consent in the Microsoft corporate environment to the actor controlled malicious OAuth applications." Finally, it used the legacy test application to grant itself the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes. Microsoft found the activity by reviewing Exchange Web Services (EWS) activity and audit logs.

Microsoft has not said exactly which permissions the legacy test app held, or how a test app came to have elevated access to the corporate tenant.

On 8 March 2024, Microsoft updated its disclosure. It said it had seen "evidence that Midnight Blizzard is using information initially exfiltrated from our corporate email systems to gain, or attempt to gain, unauthorized access", including to "some of the company's source code repositories and internal systems." It also said that "Some of these secrets were shared between customers and Microsoft in email", that it was contacting those customers, and that the actor had increased the volume of password sprays "by as much as 10-fold in February" compared with January.

The US government was among those customers. CyberScoop reported that CISA issued Emergency Directive 24-02 on 2 April 2024 and made it public on 11 April. The directive said the theft of correspondence between agencies and Microsoft "presents a grave and unacceptable risk to agencies", and required affected agencies to reset exposed credentials and identify affected email. In late June 2024, SecurityWeek reported that Microsoft was notifying more customers that "emails were exchanged between Microsoft and accounts in your organization, and those emails were accessed by the threat actor Midnight Blizzard".

The same actor was also inside Hewlett Packard Enterprise. In an 8-K filed on 19 January 2024, HPE said it had been notified on 12 December 2023 that Midnight Blizzard had gained unauthorised access to its cloud-based email environment. HPE said it believed the actor "accessed and exfiltrated data beginning in May 2023" from a small percentage of mailboxes, and that the incident was likely related to earlier SharePoint file theft it had been told about in June 2023. HPE has not said how the actor got in.

Timeline

How it happened: the identity attack path

1. A forgotten test account. A legacy, non-production test tenant account had no MFA. A slow, low-volume password spray from residential proxy addresses found its password without tripping lockouts.
2. A legacy app with production reach. From that foothold the actor found a legacy test OAuth application that, according to Microsoft, "had elevated access to the Microsoft corporate environment".
3. New apps, new consent. The actor registered its own malicious OAuth applications and created a new user account to grant them consent in the corporate environment.
4. Tenant-wide mailbox access. Using the legacy app, it granted the Exchange Online full_access_as_app role, an application permission that reads mailboxes without signing in as each user.
5. Targeted collection. The actor exfiltrated email and attachments, starting with what Microsoft knew about Midnight Blizzard.
6. Secrets in the inbox. Stolen messages contained secrets shared by customers and credentials used by federal agencies, which the actor then tried to use against Microsoft's source code repositories and internal systems.

Impact

• Microsoft email: a "very small percentage" of corporate mailboxes, in Microsoft's words, including senior leadership and cybersecurity and legal staff.
• Source code and internal systems: by March 2024 Microsoft said the actor had used stolen information to gain, or attempt to gain, access to some source code repositories and internal systems. It said it found no evidence that customer-facing systems hosted by Microsoft were compromised.
• Customers and government: email correspondence with customers and US federal agencies was exposed, including authentication secrets in some cases. CISA required agencies to reset affected credentials by 30 April 2024, according to CyberScoop.
• HPE: a small percentage of mailboxes and a limited number of SharePoint files, according to HPE, which also reported no material impact on operations at the time of filing.

What this means for NHI governance

The password spray was the way in, but the breach itself was carried out by non-human identities. Once the actor controlled OAuth applications holding full_access_as_app, it no longer needed any executive's password or MFA. An application permission like that is effectively a master key to every mailbox in scope, and it keeps working while user passwords are reset and sessions are revoked.

Three governance gaps stand out. First, the test tenant and its legacy app were outside the controls applied to production. Microsoft itself said it would "apply our current security standards to Microsoft-owned legacy systems and internal business processes, even when these changes might cause disruption". Second, a test app had elevated access to the corporate environment, which means nobody had matched what the app was for with what it was allowed to do. Third, the actor could create new apps and consent to them without that change being caught before mail was read. Each of these is a lifecycle and ownership failure, not a software flaw.

The later fallout is just as instructive. Customers and agencies had emailed secrets to Microsoft, so a mailbox compromise became a credential compromise for other organisations. SecurityWeek notes that the same group was responsible for the 2020 SolarWinds supply chain attack, which also turned application identities against their owners.

Recommendations

• Inventory every OAuth app and service principal, including in test tenants. Give each an owner and purpose, and remove those without one. The SaaS-to-SaaS and OAuth App Governance Guide sets out a workable process.
• Hunt for high-risk application permissions. Review which apps hold full_access_as_app, ApplicationImpersonation or broad directory roles, as Microsoft advises, and scope Exchange access to specific mailboxes where it is genuinely needed.
• Bring test and legacy tenants under production standards. Enforce MFA on every user account, block legacy authentication and remove any trust path from test environments into corporate ones. See the Active Directory and Entra ID Hardening Guide.
• Alert on app creation, credential changes and consent grants. New app registrations, new secrets or certificates on existing apps, new user accounts granting consent and new application role assignments should all raise alerts, as covered in the ITDR Guide.
• Keep secrets out of email. Share credentials through a secrets manager or a one-time mechanism, and rotate anything that has been sent by email, following the Secrets Management Guide.

Frequently asked questions

What happened in the Microsoft Midnight Blizzard breach?

Russian state actor Midnight Blizzard used a password spray to take over a legacy test tenant account without MFA at Microsoft, then abused a legacy test OAuth application and new malicious OAuth apps to read and steal email from senior leadership and security, legal and other staff between late November 2023 and January 2024.

How did Midnight Blizzard get into Microsoft executives' email?

Microsoft says the actor granted its OAuth applications the Exchange Online full_access_as_app role, an application permission that allows access to mailboxes without a user signing in.

Were Microsoft customers affected by the Midnight Blizzard attack?

Microsoft said it found no evidence that Microsoft-hosted customer-facing systems were compromised. However, email that customers and US federal agencies had exchanged with Microsoft was stolen, some of it containing secrets, which led to CISA's Emergency Directive 24-02 and customer notifications in 2024.

Related NHI Mgmt Group resources

SolarWinds supply chain compromise · Microsoft Azure key breach · Microsoft OAuth breach · OAuth App Governance Guide · NHI breaches

How NHI Mgmt Group can help

Midnight Blizzard read Microsoft's executive email through OAuth applications and application permissions that nobody was watching closely enough, not through the executives' own accounts. Our NHI Foundation Level Training Course teaches teams how to find, own and govern app registrations, service principals and secrets across every tenant.

References

• Microsoft Security Response Center: Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard (19 January 2024)
• Microsoft: Form 8-K, Item 1.05 Material Cybersecurity Incidents (19 January 2024)
• Microsoft Threat Intelligence: Midnight Blizzard, Guidance for responders on nation-state attack (25 January 2024)
• Microsoft Security Response Center: Update on Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard (8 March 2024)
• Microsoft: Form 8-K/A, Item 1.05 Material Cybersecurity Incidents (8 March 2024)
• Hewlett Packard Enterprise: Form 8-K, Item 1.05 Material Cybersecurity Incidents (19 January 2024)
• CyberScoop: CISA emergency directive tells agencies to fix credentials after Microsoft breach (11 April 2024)
• SecurityWeek: Microsoft Alerts More Customers to Email Theft in Expanding Midnight Blizzard Hack (28 June 2024)