Microsoft’s public guidance says Midnight Blizzard used password spray attacks to compromise a legacy, non-production test tenant account that did not have MFA enabled. Microsoft also describes the actor as adept at identifying and abusing OAuth applications to move laterally across cloud environments and for post-compromise activity such as email collection.
Microsoft then describes the OAuth stage: the actor identified and compromised a legacy test OAuth application with elevated access to Microsoft’s corporate environment, created additional OAuth applications, created a user account to grant consent, and used the legacy test OAuth application to grant the Office 365 Exchange Online full_access_as_app role, which allows access to mailboxes.
Microsoft’s guidance after the incident tells defenders to audit the privilege level of identities, users, service principals, and applications — especially unknown, unused, no-longer-used, or overprivileged identities.
CISA later issued Emergency Directive 24-02 concerning the risk from the nation-state compromise of Microsoft’s corporate email system, further underscoring that this was not a narrow misconfiguration problem. It was an enterprise risk event tied to identity, email, credentials, and trust.
