Microsoft has disclosed that its corporate systems fell victim to a cyberattack orchestrated by a Russian-linked hacking group in November 2023, the company revealed in a statement on Friday (19 Jan).
The assailants, identified as Midnight Blizzard or Nobelium, breached a series of email accounts, including those belonging to top-level executives and employees working in cybersecurity and legal departments.
Microsoft confirmed its immediate response to rectify vulnerabilities in older systems, a move that may result in some disruption.
Go deeper with GlobalData
In a statement, the company clarified, however, that the hacking group did not compromise customers’ systems or Microsoft servers hosting outward-facing products.
The group responsible for the attack, also known as Nobelium and associated with Russia’s SVR spy agency, has a history of sophisticated cyber-espionage activities.
Previously, it was linked to the SolarWinds breach, part of a larger effort targeting US federal agencies. Microsoft provided assurance that despite the intrusion, its widely-used products were not compromised.
The cyber intruders, employing a technique known as a ‘password spray’ attack, initiated the breach in November 2023.
This method involves rapid attempts of multiple passwords on specific usernames to gain unauthorised access to targeted corporate accounts. Alongside compromised accounts, the attackers also obtained emails and attached documents.
Microsoft detected the breach on 12 January and the company is currently notifying affected employees.
Microsoft, a frequent target of major hacking campaigns, has been under scrutiny for its security practices. The US Cyber Safety Review Board, responsible for assessing cybersecurity incidents, is already investigating a 2023 intrusion against Microsoft Exchange Online attributed to China-linked hackers.
In response to previous security incidents, Microsoft announced an overhaul of its software and system protection measures in November 2023.
The recent cyberattack has highlighted the pressing need to expedite security enhancements, particularly for older systems and products.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataAccording to Cybersecurity Ventures, global cybercrime will reach $10.5trn annually by 2025. Tackling this issue requires investment, and GlobalData forecasts that cybersecurity revenues will reach $344bn worldwide by 2030.
Attacks on critical national infrastructure and supply chains will also increase
in 2023. These are highly effective at causing large-scale disruption and longlasting financial impact.
