Hackers breached Microsoft to find out what Microsoft knows about them
Wouldn’t you want to know what tech giants know about you? That’s exactly what Russian government hackers want, too.
On Friday, Microsoft disclosed that the hacking group it calls Midnight Blizzard, also known as APT29 or Cozy Bear — and widely believed to be sponsored by the Russian government — hacked some corporate email accounts, including those of the company’s “senior leadership team and employees in our cybersecurity, legal, and other functions.”
Curiously, the hackers didn’t go after customer data or the traditional corporate information they may have normally gone after. They wanted to know more about themselves, or more specifically, they wanted to know what Microsoft knows about them, according to the company.
Contact Us
Do you have more information about this hack? We’d love to hear from you. From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or email lorenzo@techcrunch.com. You also can contact TechCrunch via SecureDrop.
“The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself,” the company wrote in a blog post and SEC disclosure.
According to Microsoft, the hackers used a “password spray attack” — essentially brute forcing — against a legacy account, then used that account’s permissions “to access a very small percentage of Microsoft corporate email accounts.”
Microsoft did not disclose how many email accounts were breached, nor exactly what information the hackers accessed or stole.
Company spokespeople did not immediately respond to a request for comment.
Microsoft took advantage of news of this hack to talk about how they are going to move forward to make itself more secure.
“For Microsoft, this incident has highlighted the urgent need to move even faster. We will act immediately to apply our current security standards to Microsoft-owned legacy systems and internal business processes, even when these changes might cause disruption to existing business processes,” the company wrote. “This will likely cause some level of disruption while we adapt to this new reality, but this is a necessary step, and only the first of several we will be taking to embrace this philosophy.”
APT29, or Cozy Bear, is widely believed to be a Russian hacking group working responsible for a series of high-profile attacks, such as those against SolarWinds in 2019, the Democratic National Committee in 2015, and many more.