Loading story…
Microsoft disclosed that Midnight Blizzard (APT29/NOBELIUM) breached its corporate environment by password-spraying a legacy non-production tenant account without MFA, then abusing OAuth applications and the full_access_as_app role to access Exchange Online mailboxes. Microsoft said the Russian state-backed actor used distributed residential proxy infrastructure to hide its activity, while Mandiant separately documented the same group using residential proxies, Microsoft-owned IP space via external Azure subscriptions, MFA self-enrollment abuse, and audit-log suppression to blend into normal Microsoft 365 traffic and sustain email collection against government and policy targets.
A broader analysis of the residential proxy market found that these services are widely available through cybercrime forums and are increasingly used by both espionage actors and criminal groups for attribution resistance, phishing, spam, DDoS, and fraud. The report said proxy pools are built through proxyware installs, embedded SDKs, and compromised systems, and identified links among providers including PiaS5Proxy, ABCProxy, and 922Proxy through shared cryptocurrency wallets and Hong Kong-linked entities, underscoring how opaque proxy ecosystems can materially support stealthy nation-state operations and prompting recommendations to detect and block proxyware inside enterprise environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On January 25, 2024, Microsoft publicly disclosed the Midnight Blizzard intrusion, describing password-spray access to a legacy non-production test tenant account without MFA, abuse of OAuth applications, Exchange Online mailbox access, and use of distributed residential proxy infrastructure. Microsoft also said it had begun notifying other organizations targeted by the actor and published detection and hardening guidance.
Microsoft detected a nation-state attack on its corporate systems on January 12, 2024, and immediately activated its incident response process. The company attributed the intrusion to Midnight Blizzard, also known as APT29/NOBELIUM.
The Sekoia.io report notes that IPRoyal rebranded to Pawns.app in December 2023.
Researchers documented a 2023 incident in which an attacker gained SSH access to a partner system and clandestinely installed Pawns.app proxyware with persistence via cron jobs and service modification.
The Sekoia.io study found that the majority of the residential proxy providers it analyzed had emerged during 2023.
Sekoia.io and Orange Cyberdefense analyzed more than 50 residential proxy offerings advertised on forums including BreachForums, Nulled, XSS, BlackHatWorld, and Zelenka during 2023.
In 2022, Mandiant observed APT29 targeting organizations involved in shaping NATO countries’ foreign policy and revisiting previously compromised victims.
Mandiant states it has tracked APT29, a Russian espionage group likely sponsored by Russia’s SVR, since at least 2014.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
blog.sekoia.io
Open sourcecadosecurity.com
Open sourcemicrosoft.com
Open sourcemandiant.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Authorities and private-sector partners disrupted an **APT28** campaign known as **FrostArmada** that hijacked DNS traffic on compromised SOHO routers to steal Microsoft 365 credentials and OAuth tokens. Investigators said the operation abused **MikroTik**, **TP-Link**, some **Nethesis**, and older **Fortinet** devices, redirecting authentication traffic through attacker-controlled VPS infrastructure to perform adversary-in-the-middle interception. Microsoft and Lumen Black Lotus Labs traced the activity, identified victims, and supported action by the **FBI**, the **U.S. Department of Justice**, and Polish authorities to take malicious infrastructure offline. At its peak in December 2025, the campaign had infected about **18,000 devices in 120 countries** and affected government agencies, law enforcement, IT and hosting providers, and organizations running their own servers. The disruption comes amid broader warnings that Russia-linked **Fancy Bear**—also tracked as **APT28**, **Forest Blizzard**, and **Pawn Storm**—continues global cyber-espionage and disruptive operations. Recent reporting tied the group not only to router-based DNS hijacking, including abuse of TP-Link devices and exploitation of **`CVE-2023-50224`**, but also to **NTLMv2** hash relay attacks leveraging Outlook flaw **`CVE-2023-23397`** and malware activity targeting Ukraine’s defense supply chain and allied countries. Security guidance from Microsoft, the UK NCSC, researchers, and government agencies urged organizations to harden routers, patch internet-facing systems, enable MFA, reduce external exposure, remove end-of-life equipment, and adopt certificate pinning and zero-trust controls to limit credential theft and follow-on compromise.
Jun 29, 2026
Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a subgroup of the Russian state-backed **Midnight Blizzard** actor, after attackers compromised captive portal ecosystems used by hospitality organizations and other shared public venues. By manipulating **DNS** and **HTTP** traffic on public Wi-Fi gateway infrastructure, the group conducted **adversary-in-the-middle (AiTM)** attacks that intercepted login flows and stole **Microsoft 365** credentials from traveling employees across multiple sectors. The operation also pushed follow-on malware and phishing lures through the hijacked portals. Victims were shown fake browser update prompts delivering malware including **CornFlake** and **ChocoShell**, alongside **ClickFix**-style social engineering and malicious Android **APK** prompts; some recent landing pages also added **device code phishing**, a technique Microsoft said Midnight Blizzard has used since 2024. The campaign has reportedly been active since May and focused on hospitality-linked networks and other public access environments where users expect captive portal authentication.
Aug 6, 2026
German authorities warned that the Chinese-linked espionage group **APT27** was compromising commercial networks and maintaining access with the **HyperBro** remote access trojan, an in-memory backdoor used for persistence, remote administration, and data theft. The campaign was tied to exploitation of Microsoft Exchange **ProxyLogon** flaws, including `CVE-2021-26855`, `CVE-2021-26857`, `CVE-2021-26858`, and `CVE-2021-27065`, as well as overlap with attacks abusing Zoho ManageEngine vulnerabilities. Officials said the intrusions could expand into supply-chain compromises affecting customers and service providers, and released indicators of compromise and YARA rules to help defenders detect HyperBro and related command-and-control activity. Incident reports and threat research showed the Exchange compromises typically began with web shell deployment on exposed servers, followed by PowerShell-based reconnaissance, Active Directory enumeration, LSASS dumping, mailbox access, and attempts to package stolen data for exfiltration. In one detailed enterprise case attributed to APT27, the attackers moved laterally across multiple domains, escalated to domain administrator, extracted `NTDS.DIT`, staged data in password-protected RAR archives, and exfiltrated gigabytes of information through the Exchange server and HyperBro infrastructure while using DLL side-loading, masquerading, renamed tools, and Defender exclusions to evade detection. Researchers also warned that patching Exchange alone was not enough because many victims likely remained compromised through persistent web shells and other payloads.
Aug 15, 2026