Russian military hackers are reportedly using compromised Microsoft 365 accounts to target businesses in the United States, and have so far successfully breached up to 40 firms.
A new report from Microsoft’s researchers claims to have spotted a group they track as Midnight Blizzard (also known as NOBELIUM, or Cozy Bear) - a known Russian state-sponsored threat actor. Apparently, the group has been using Microsoft 365 accounts, belonging to various small businesses across the country and stolen in earlier attacks, to target specific firms with phishing messages and social engineering lures distributed through Microsoft Teams. Apparently, the hackers were impersonating tech support staff and tried to get their victims to share login credentials and multi-factor authentication (MFA) keys with them.
