2024-01-26 18:00:00
A Microsoft revealed that hackers used an old account of tests without two-factor authentication to break into the company a short time ago. The attack in question allowed the invaders to have access to corporate emails of company executives.
The company reported the invasion dried up (United States Securities and Exchange Commission) on January 19th. The entity is responsible for monitoring the financial market in the USA. This Friday (26), the Microsoft revealed the details on his blog.
According to Microsoft, the attack was an action by the Russian group Midnight Blizzard, which used the password spray technique, in which hackers usually use common passwords to try to enter multiple accounts at the same time.
The company cited that the hacker group still managed to adapt password spraying attacks to a limited number of accounts, with few attempts to remain undetected. The strategy worked and the attackers managed to access an account.
According to Microsoft, the hacked account was a test one and not productive. Therefore, she it was not used for work, just for testing an old environment. Therefore, it did not have two-factor authentication (2FA), which made hacking easier.
In control of the account, hackers compromised a test application with OAuth authentication and used it to gain further access to Microsoft systems. The company also warned that other corporate organizations are at risk.
1706316236
#Hackers #account #twofactor #authentication #break #Microsoft