Midnight Blizzard / Microsoft - Password Spray on a Forgotten Test Tenant → A Legacy OAuth App With Production Rights → Executive Email → Secrets in That Email → Source Code
From late November 2023, the Russian state actor Midnight Blizzard (APT29 / NOBELIUM) ran a password spray against a legacy, non-production test tenant belonging to Microsoft. One account there had a guessable password and no multi-factor authentication. That account had access to a legacy OAuth application which, for historical reasons, held elevated permissions into Microsoft's corporate environment - and from there the actor read the email of senior leadership, cybersecurity and legal staff. Microsoft detected it on January 12, 2024 and disclosed a week later. The March update is the part that matters most: Microsoft found the actor was using secrets that customers and Microsoft had exchanged in those emails to reach further, including some source code repositories and internal systems, and that password spray attempts had risen as much as tenfold in February. The initial access was an account nobody owned, in an environment nobody considered production.
Password spraying tries a small number of common passwords against many accounts, staying under lockout thresholds and per-account rate limits. Run from a residential proxy network, it also defeats naive IP-based detection because each attempt appears to come from a different ordinary address. What made it succeed was not the technique but the target: a test tenant, created for some purpose long since served, outside whatever MFA enforcement and password policy governed Microsoft's real estate. Nobody was reviewing it because it was not production, and it did not appear in the inventories that drive security baselines - which is precisely why it still existed.
Infrastructure: Residential proxy network, so attempts look like ordinary users
Target: A legacy non-production test tenant
The account: Weak, guessable password; no MFA
Why it survived: Not production, so not in the inventory that drives baselines
This is the hinge, and it is the reason a test-environment compromise became a corporate one. An OAuth application registered long ago held permissions into the production corporate environment - a configuration that presumably made sense when it was created and had simply never been revisited. The actor used that application to grant itself access, creating additional malicious OAuth applications along the way and using them to reach Office 365 Exchange Online mailboxes. The general shape recurs across this site: Vercel / Context.ai, Salesloft Drift and UNC6040 all turn on an OAuth grant outliving the reason it was made. A non-production identity should not be able to reach a production application, and an old application should not still hold rights nobody would grant today.
Actor actions: Used it to grant further access; created additional malicious OAuth apps
Reached: Office 365 Exchange Online mailboxes
Two failures: Non-prod identity reaching prod, and an old grant nobody revisited
Recurring shape: Vercel / Context.ai, Salesloft Drift, UNC6040
The mailbox selection is intelligence work rather than opportunism. Senior leadership for strategy, legal for what is contested and disclosed, and cybersecurity for what the defender knows - Microsoft stated the actor was targeting email accounts for information related to Midnight Blizzard itself. An actor reading the security team's mail during an active intrusion has an advantage that is difficult to overstate: they can see the investigation forming. It is the strongest possible argument for keeping incident response communications on an out-of-band channel that does not depend on the environment being investigated.
Specific interest: Information about Midnight Blizzard itself
Advantage gained: Visibility of the defender's own investigation as it formed
Countermeasure: Out-of-band IR communications, independent of the environment under investigation
Detected: January 12, 2024; disclosed January 19
The revision is the most valuable part of this chain, and it deserves credit for being published. Mailbox access was not the end state - it was a credential store. People send secrets in email: connection strings while debugging, API keys to a partner, a password "just this once" in a thread that never gets deleted. Microsoft found the actor mining exfiltrated mail for exactly that and using what it found to reach some source code repositories and internal systems, and proactively contacted customers whose secrets appeared. Microsoft also reported password spray attempts running as much as tenfold higher in February than in the already-large January volume. Read together: assume every mailbox in your organization contains credentials, because it does.
Customer impact: Secrets shared between customers and Microsoft were found; those customers were contacted
Escalation: Password spray attempts up as much as 10x in February vs January
Microsoft's position: No evidence customer-facing systems were compromised
The transferable lesson: Every mailbox is a credential store