Microsoft Actions Following Attack by Nation State Actor Midnight Blizzard | Microsoft Security Response Center
msrc.microsoft.com/blog/2024/01/microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard
What Jamie wrote
Initial information on Microsoft security event.
Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents.
Highlights how all public endpoints matter, production or not.