According to Microsoft’s MSRC blog on 19 January 2024, Midnight Blizzard (Nobelium) password-sprayed a legacy non-production test tenant account beginning in late November 2023, then used that account’s permissions against a very small percentage of Microsoft corporate email accounts and exfiltrated some emails and attachments. Public reporting frames the sprayed account as lacking MFA. Phishing-proof MFA 2.0 on every workforce and legacy or test tenant account removes the password-only surface so that spray cannot finish interactive sign-in; OAuth application abuse and mailbox collection after a successful login are separate authorization problems. For the full attack-chain narrative, read the companion on legacymfa.sucks.
FAQ
Would MFA 2.0 have stopped Midnight Blizzard’s initial access to Microsoft?
Yes. MFA 2.0 would have stopped Midnight Blizzard’s initial access on the sprayed Microsoft legacy non-production test tenant account because that path was password-only interactive sign-in. Password spray only works when a guessed or reused password is enough. Device-bound, phishing-proof credentials leave no central password to spray and require a hardware-bound signature from an already-enrolled device, so the spray never completes login. That is prevention, not detection: the foothold never forms at the credential gate.
Does MFA 2.0 undo OAuth app abuse and mailbox access after the spray?
No. MFA 2.0 does not undo OAuth application abuse or limited corporate mailbox access after Midnight Blizzard already held a signed-in Microsoft account. Those steps are authorization and session-stage work after authentication succeeded. Consent governance, app review, least privilege, and revoke address residual grants. Login cryptography cannot retract permissions an attacker already exercised from a compromised account.
Should non-production and test tenants get the same phishing-proof MFA?
Yes. Non-production and test tenants need the same phishing-proof MFA 2.0 as production workforce accounts when they can reach corporate mail or other sensitive permissions. Midnight Blizzard’s Microsoft foothold started on a legacy non-production test tenant account without MFA, then used that account’s permissions against a very small percentage of corporate email. “Test” does not mean “out of the blast radius.” Treat every interactive identity that can mint useful access as a first-class authentication surface.
Are passkeys alone enough against this password-spray pattern?
Passkeys are phishing-resistant at the login ceremony and would defeat a pure password spray on accounts that actually require them. They still leave a lifecycle gap if enrollment, recovery, or leftover password paths stay phishable or password-only on some tenants. MFA 2.0 is phishing-proof across registration, device onboarding, authorization, authentication, and decommissioning, so no transferable password remains on workforce or legacy test accounts. Against Midnight Blizzard’s Microsoft path, the decisive fix is eliminating the MFA-absent password gate everywhere, not only hardening one production login screen.
What should defenders prioritize once the spray path is closed?
Once every workforce and legacy or test tenant account requires device-bound phishing-proof sign-in, prioritize OAuth consent governance, least privilege on mailbox and app permissions, and fast revoke for any residual session. Closing the phishable or password-only login stops this Midnight Blizzard spray path. Malware after a legitimate login is a harder, separate problem. The device-bound architecture removes the credential the spray needed; residual app and mail controls clean up what no login MFA can unwind.
