Midnight Blizzard | How Russian Intelligence Breached Microsoft

With guest CISO Co-Host Alyssa Robinson, CISO at HubSpot

In late 2023, a Russian state-sponsored threat actor known as Midnight Blizzard (also called NOBELIUM and widely associated with APT29) began probing Microsoft the old-fashioned way: password spraying.

No zero-day. No smash-and-grab.

Just patience, repetition, and one legacy gap.

Microsoft says the actor compromised a legacy, non-production test tenant account and used that foothold to access a very small percentage of Microsoft corporate email accounts, including members of senior leadership and employees in cybersecurity and legal, then exfiltrated some emails and attached documents. Microsoft detected the attack on January 12, 2024, and disclosed it publicly on January 19, 2024.
Microsoft

This was espionage, not extortion: Microsoft assessed the actor was initially seeking information related to Midnight Blizzard itself, essentially trying to learn what Microsoft knew about their operations.
Microsoft
+1

In this episode of The CISO Signal | True Cybercrime Podcast, we break down how a nation-state operation targets the most valuable asset in modern security: identity. We explore why executive inboxes are intelligence gold, why slow intrusions are so hard to see in real time, and what incident response looks like when the adversary is collecting insight, not detonating ransomware.

🎙 Guest CISO Co-Host

Alyssa Robinson
Chief Information Security Officer, HubSpot

🔍 Episode Topics

• How password spraying still works at massive scale
• Why legacy test tenants and exceptions become the entry point
• Executive identity risk and the “convenience gap”
• What changes when the attacker is a nation state
• The trust question: what downstream organizations must assume

🧊 The aftershock

Microsoft later reported evidence that the actor was using exfiltrated information to pursue additional unauthorized access, including some source code repositories and internal systems, while stating it found no evidence that Microsoft-hosted customer-facing systems were compromised.
Microsoft

CISA also issued guidance on SVR / APT29 tradecraft for initial cloud access (AA24-057A) and an Emergency Directive tied to this compromise (ED 24-02).
CISA
+1

🧩 About The CISO Signal
True cybercrime storytelling with real CISO lessons. Subscribe so you never miss an investigation.
👉 / @thecisosignal
www.linkedin.com/company/the-ciso-signal

#CISOSignal #MicrosoftBreach #MidnightBlizzard #APT29 #NOBELIUM
#CyberEspionage #IdentitySecurity #CloudSecurity #CISO #TrueCybercrime

The HubSpot Hack | The SaaS Backdoor to Bitcoin - ft. Scott Kisser (CISO, Swan Bitcoin)
When attackers breached HubSpot in March 2022, they weren’t after HubSpot at all.

They were after the customers of its customers.

Crypto firms like Trezor, BlockFi, and Swan Bitcoin suddenly saw their users targeted by near-perfect phishing emails designed to steal recovery seeds and drain wallets. And just weeks later, another SaaS provider, Klaviyo, was hit the same way. The message was clear:

You can defend your castle…
but attackers will go after the people guarding your gates.

This week on The CISO Signal | True Cybercrime Podcast, we dissect the SaaS-supply-chain breach that shook the crypto world and the coordinated response that stopped it from becoming a full-scale disaster.

🎙 Guest CISO Co-Host: Scott Kisser
Chief Information Security Officer – Swan Bitcoin
Former security leader at Salesforce, DocuSign, Amazon, and F5.

Scott takes us inside the incident response:
• How a single phished employee put the SaaS ecosystem at risk
• Why crypto companies were the downstream target
• The race to warn customers before attackers drained wallets
• How CISOs must rethink vendor access and trust assumptions
• Why no major funds were stolen — and why that victory matters

This wasn’t a tale of ransomware, it was a breach of trust.
And a reminder that SaaS is now part of every organization’s attack surface.

🔍 Episode Topics

• Vendor compromise → internal tool access → crypto user phishing

• The human element behind SaaS security

• What leadership communication looks like when trust is shaken

• The new rules of defending against third-party attack vectors

🏴‍☠️ Key Players
• HubSpot — initial breach vector
• Klaviyo — second SaaS compromise
• Trezor & Swan Bitcoin — downstream targets
• Crypto customers — the true victims
• CISOs — left to restore confidence & reshape strategy

💡 Takeaway for CISOs
“You’re only as strong as the SaaS identities you can’t see.”

🧩 About The CISO Signal
Hollywood-style storytelling meets real cybersecurity lessons.
Every episode, CISOs break down the world’s most notorious cyberattacks — what happened, what broke, and what must change.

Subscribe & ring the bell so you never miss an investigation. 🛎️
👉 / @thecisosignal

📣 Connect with Us
🌐 Website: thecisosignal.transistor.fm
🔗 LinkedIn: linkedin.com/company/the-ciso-signal
Subscribe & share to stay ahead of the world’s most sophisticated cyber threats.

🔥 Hashtags
#CISOSignal #HubSpotBreach #Klaviyo #SaaSSecurity #CryptoSecurity #SupplyChainAttack #SocialEngineering #Phishing #SecurityPodcast #TrueCybercrime #ScottKisser #SwanBitcoin #Trezor

In late 2023, the world’s most trusted identity provider experienced the kind of breach it was designed to prevent. Attackers quietly infiltrated Okta’s customer support system, stole session tokens hidden inside HAR files and used them to impersonate users across some of the most secure organizations on earth.

For two full weeks, the intruders operated in silence. No alerts. No red flags. No detection.

When the truth came out, it wasn't just a security incident, it was a crisis of trust in the infrastructure that underpins modern authentication.
How did a company synonymous with identity become a cautionary tale? What does this breach reveal about session tokens as the new crown jewels, third-party risk, and the blind spots that even top-tier security teams can miss? And what lessons does every CISO need to take from the Okta compromise before history repeats itself?

In this episode of The CISO Signal: True Cybercrime Podcast, host Jeremy Ladner is joined by Oren Zenescu, CISO at Plarium, to break down every layer of the Okta breach, from the silent entry and token theft to the fallout across the cybersecurity community and what it means for the future of identity security.

💡 In this episode, we discuss:
🔹 How attackers harvested HAR files and hijacked live session tokens
🔹 Why session tokens are becoming the primary target for modern attackers
🔹 The two-week detection delay and what it says about support system security
🔹 What the Okta breach means for zero trust, vendor reliance, and third-party risk
🔹 Lessons CISOs must take from Okta’s incident history Lapsus$, source code theft, and beyond

🎙 Featured Guest
Oren Zenescu | Global CISO at Plarium
Member of Team8 CISO Village, with 15+ years of enterprise security leadership across finance, gaming, and global tech.

Follow The CISO Signal
🌐 Website: thecisosignal.transistor.fm
🔗 LinkedIn: linkedin.com/company/the-ciso-signal
Subscribe & share to stay ahead of the world’s most sophisticated cyber threats.

#CyberSecurity #OktaBreach #IdentitySecurity #TokenHijacking #ZeroTrust #CISO #IncidentResponse #SupplyChainSecurity #CyberCrime #TheCisoSignal