Midnight Blizzard | How Russian Intelligence Breached Microsoft

With guest CISO Co-Host Alyssa Robinson, CISO at HubSpot

In late 2023, a Russian state-sponsored threat actor known as Midnight Blizzard (also called NOBELIUM and widely associated with APT29) began probing Microsoft the old-fashioned way: password spraying.

No zero-day. No smash-and-grab.

Just patience, repetition, and one legacy gap.

Microsoft says the actor compromised a legacy, non-production test tenant account and used that foothold to access a very small percentage of Microsoft corporate email accounts, including members of senior leadership and employees in cybersecurity and legal, then exfiltrated some emails and attached documents. Microsoft detected the attack on January 12, 2024, and disclosed it publicly on January 19, 2024.
Microsoft

This was espionage, not extortion: Microsoft assessed the actor was initially seeking information related to Midnight Blizzard itself, essentially trying to learn what Microsoft knew about their operations.
Microsoft
+1

In this episode of The CISO Signal | True Cybercrime Podcast, we break down how a nation-state operation targets the most valuable asset in modern security: identity. We explore why executive inboxes are intelligence gold, why slow intrusions are so hard to see in real time, and what incident response looks like when the adversary is collecting insight, not detonating ransomware.

🎙 Guest CISO Co-Host

Alyssa Robinson
Chief Information Security Officer, HubSpot

🔍 Episode Topics

• How password spraying still works at massive scale
• Why legacy test tenants and exceptions become the entry point
• Executive identity risk and the “convenience gap”
• What changes when the attacker is a nation state
• The trust question: what downstream organizations must assume

🧊 The aftershock

Microsoft later reported evidence that the actor was using exfiltrated information to pursue additional unauthorized access, including some source code repositories and internal systems, while stating it found no evidence that Microsoft-hosted customer-facing systems were compromised.
Microsoft

CISA also issued guidance on SVR / APT29 tradecraft for initial cloud access (AA24-057A) and an Emergency Directive tied to this compromise (ED 24-02).
CISA
+1

🧩 About The CISO Signal
True cybercrime storytelling with real CISO lessons. Subscribe so you never miss an investigation.
👉 / @thecisosignal
www.linkedin.com/company/the-ciso-signal

#CISOSignal #MicrosoftBreach #MidnightBlizzard #APT29 #NOBELIUM
#CyberEspionage #IdentitySecurity #CloudSecurity #CISO #TrueCybercrime

The HubSpot Hack | The SaaS Backdoor to Bitcoin - ft. Scott Kisser (CISO, Swan Bitcoin)
When attackers breached HubSpot in March 2022, they weren’t after HubSpot at all.

They were after the customers of its customers.

Crypto firms like Trezor, BlockFi, and Swan Bitcoin suddenly saw their users targeted by near-perfect phishing emails designed to steal recovery seeds and drain wallets. And just weeks later, another SaaS provider, Klaviyo, was hit the same way. The message was clear:

You can defend your castle…
but attackers will go after the people guarding your gates.

This week on The CISO Signal | True Cybercrime Podcast, we dissect the SaaS-supply-chain breach that shook the crypto world and the coordinated response that stopped it from becoming a full-scale disaster.

🎙 Guest CISO Co-Host: Scott Kisser
Chief Information Security Officer – Swan Bitcoin
Former security leader at Salesforce, DocuSign, Amazon, and F5.

Scott takes us inside the incident response:
• How a single phished employee put the SaaS ecosystem at risk
• Why crypto companies were the downstream target
• The race to warn customers before attackers drained wallets
• How CISOs must rethink vendor access and trust assumptions
• Why no major funds were stolen — and why that victory matters

This wasn’t a tale of ransomware, it was a breach of trust.
And a reminder that SaaS is now part of every organization’s attack surface.

🔍 Episode Topics

• Vendor compromise → internal tool access → crypto user phishing

• The human element behind SaaS security

• What leadership communication looks like when trust is shaken

• The new rules of defending against third-party attack vectors

🏴‍☠️ Key Players
• HubSpot — initial breach vector
• Klaviyo — second SaaS compromise
• Trezor & Swan Bitcoin — downstream targets
• Crypto customers — the true victims
• CISOs — left to restore confidence & reshape strategy

💡 Takeaway for CISOs
“You’re only as strong as the SaaS identities you can’t see.”

🧩 About The CISO Signal
Hollywood-style storytelling meets real cybersecurity lessons.
Every episode, CISOs break down the world’s most notorious cyberattacks — what happened, what broke, and what must change.

Subscribe & ring the bell so you never miss an investigation. 🛎️
👉 / @thecisosignal

📣 Connect with Us
🌐 Website: thecisosignal.transistor.fm
🔗 LinkedIn: linkedin.com/company/the-ciso-signal
Subscribe & share to stay ahead of the world’s most sophisticated cyber threats.

🔥 Hashtags
#CISOSignal #HubSpotBreach #Klaviyo #SaaSSecurity #CryptoSecurity #SupplyChainAttack #SocialEngineering #Phishing #SecurityPodcast #TrueCybercrime #ScottKisser #SwanBitcoin #Trezor