Microsoft has revealed more details about how Russian hacking group Cozy Bear, also known as APT29, gained access to its network and stole internal emails and files. The compromised account used in the attack did not have multi-factor authentication (MFA) enabled, allowing the hackers to utilize password spray attacks. This type of attack involves attempting to log into multiple accounts using one password at a time, to avoid triggering monitoring systems. Once the hackers gained access to a non-production Microsoft system, they exploited a legacy test OAuth application, created additional malicious OAuth applications, and used a new user account to grant consent for these applications. With this access, they were able to steal emails and files from corporate inboxes. To make their traffic appear legitimate, Cozy Bear used residential broadband networks as proxies. Microsoft has admitted that its lack of MFA protection was a mistake and has stated its intention to fast-track MFA across the board. The company has also provided guides for administrators on how to avoid similar compromises. This incident serves as a reminder of the importance of implementing strong security measures, including multi-factor authentication, to protect against cyber attacks.
Microsoft reveals how Russia’s Cozy Bear hacked its email system
![](https://cybersecuritypeek.com/wp-content/uploads/2024/01/cybersecurity-images-31.jpg)
Latest from News
![](https://cybersecuritypeek.com/wp-content/uploads/2024/01/cybersecurity-images-38-720x480.jpg)
Black Hat 2024 Cybersecurity Pulse Report – Don’t Miss Out
Cybersecurity Pulse Report Summary TLDR: Key Points Cybersecurity Pulse Report Black Hat 2024 Edition provides expert insights into critical security challenges. AI-driven analysis compiles
![](https://cybersecuritypeek.com/wp-content/uploads/2024/01/cybersecurity-images-32-720x480.jpg)
Moody’s: Cyber Insurance Competition Rises, Prices Fall
Moody’s Ratings Article Summary TLDR: Key Points: Cyber insurance market poised for growth as cyberattacks increase. New entrants in the market may lead to
![](https://cybersecuritypeek.com/wp-content/uploads/2024/01/cybersecurity-images-78-720x480.png)
Gen Alpha: Cybersecurity meets AI in a digital era
TLDR: Generation Alpha, children of Millennials, are growing up in an AI-native world where AI is an integral part of daily life. Cybersecurity in
![](https://cybersecuritypeek.com/wp-content/uploads/2024/01/cybersecurity-images-73-720x480.png)
London transport apps hit as TFL data feeds go offline
Summary of Transport for London cyber-attack article TLDR: Transport for London (TfL) has restricted access to live travel data and customer services due to
![](https://cybersecuritypeek.com/wp-content/uploads/2024/01/cybersecurity-images-89-720x480.png)
August 2024: 36 Cybersecurity M&A Deals Unveiled
“`html TLDR: Key Points: 36 cybersecurity-related M&A deals announced in August 2024 Major deals include Ark-Vantyr, Check Point-Cyberint, Cisco-Robust Intelligence, DigiCert-Vercara, EQT-Acronis Summary: Thirty-six