---
id: 7204
title: "Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices"
published_at: "2024-02-08T18:00:03Z"
tags: ["threat-detection", "microsoft", "oauth", "incident-analysis", "password-spraying", "apt29"]
phying_url: "https://phying.com/item/7204"
lang: en
---

# Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations

## Summary

Analysis of Midnight Blizzard's (APT29) breach of Microsoft: a password-sprayed legacy test tenant plus abused OAuth apps led to corporate mailbox access; with detections and hardening advice.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2024-02-08T18:00:03Z
- **Original:** https://www.wiz.io/blog/midnight-blizzard-microsoft-breach-analysis-and-best-practices
- **Phying News:** https://phying.com/item/7204