Writing
Anatomy of an Identity Incident

The Test Account That Read the Executives' Email

Anatomy of an Identity Incident — Midnight Blizzard, January 2024. A forgotten test account with no MFA, and a forgotten app with too much access, were enough to reach senior leadership's inbox.

Michael AbramovichFebruary 5, 20245 min read

Forensic write-ups of public identity breaches, strictly at the identity layer. No vendor is the villain — the point is the structural class of failure, not the logo on it.

The 60-second version

Late in 2023, a state-sponsored actor — Midnight Blizzard, also known as Nobelium — guessed its way into a legacy, non-production test tenant account that nobody had bothered to put behind multi-factor authentication. On its own, that account was worthless: a junk identity in a forgotten corner. What made it catastrophic was a second forgotten thing — a legacy test OAuth application that, for reasons lost to time, held elevated access to the real corporate environment. The attacker used the junk account to reach the over-privileged app, and the app to read corporate mailboxes belonging to senior leadership, cybersecurity, and legal.

There was no exploit and no clever malware. There was a stale account that should have had MFA and didn't, and a stale application that should have had almost no access and had far too much. Two pieces of un-decommissioned debris, bridged together, reached the executive inbox.

The identity timeline

Only identity-relevant events.

  • From late November 2023 — The actor runs a password-spray attack, deliberately low-and-slow: a few likely passwords against a limited set of accounts, few enough attempts to stay under lockout thresholds and detection.
  • The foothold — The spray succeeds against a legacy, non-production test tenant account that has no MFA. A valid username and password was all it took, because nothing else was required.
  • The bridge — Using that account, the actor reaches a legacy test OAuth application that holds elevated permissions into the corporate environment — far more access than a test app has any reason to keep.
  • The reach — Through the application's permissions, the actor accesses a small number of corporate mailboxes, including senior leadership, cybersecurity, and legal staff, and exfiltrates emails and attachments.
  • Jan 12, 2024 — The breach is detected.
  • Mid-January 2024 — Public disclosure, identifying the actor as the Russian state-sponsored Midnight Blizzard / Nobelium.

The pivot point

The pivot is the legacy OAuth application, not the sprayed password.

Password spray against an account with no MFA is the oldest move there is, and it should have yielded nothing but a dead-end test identity. The reason it didn't is the part worth staring at: a non-human identity — an application — was sitting in the environment with standing, elevated access to corporate mailboxes, long after whatever purpose it was created for had ended. Nobody was guarding it because nobody remembered it. It had no password to spray, no MFA to enable, no human to phish; it just quietly held permissions.

That is the pivot, and it is a class of identity the industry is only beginning to take seriously. We instrument human logins heavily — MFA, conditional access, impossible-travel alerts. Application and service identities often have none of that, yet they frequently hold more access than the humans, and they never log in from a suspicious location because they don't log in at all. The moment a low-value account could reach a high-privilege forgotten app, the blast radius jumped from "a test tenant" to "the leadership team's email," and it jumped through an identity nobody was watching.

What would have caught it

Naming controls, not products.

MFA with no exceptions — including the boring accounts. The foothold existed because one account was exempt. "Legacy," "test," and "non-production" are the three words that precede most of these footholds. Enforcement has to cover the accounts nobody thinks about, because those are exactly the ones the attacker sprays.

Continuous review of what every application can reach. Non-human identities need the same scrutiny as humans: what can this app access, does it still need it, who owns it? An over-permissioned, unowned OAuth app is a standing breach waiting for any foothold.

Decommissioning as a real process. Test tenants, test apps, and legacy accounts should have a lifecycle that ends. Debris that is never cleaned up is the raw material of incidents like this.

Detection tuned for low-and-slow spray. The attack deliberately stayed under volume-based thresholds. Detection that correlates small numbers of failures across accounts and time, rather than waiting for a flood, is what catches the careful version.

Treating application identity as first-class. Inventory service principals and OAuth grants, alert on new high-privilege consents, and monitor app-based access to sensitive data the way you monitor human access.

The last mile

There is something bracing about this incident: it happened to the company that builds the identity platform. If anyone has access to best-in-class tooling for MFA enforcement, app-permission review, and identity lifecycle, it is the vendor whose products provide those things. And it still had a legacy account without MFA and a legacy app with too much access. That is not a knock on the tooling. It is the clearest possible evidence that the tooling is not the hard part.

The hard part is the last mile: the continuous, unglamorous operational work of making sure every account is enrolled, every application's access is current and minimal, and every piece of legacy debris is eventually decommissioned. The product can enforce MFA — but someone has to decide it applies to the forgotten test tenant. The product can show you an app's permissions — but someone has to review them, notice that a test app can read executive email, and revoke it. None of that happens by buying the platform. It happens because an operator owns it, across the whole estate, forever, including the corners nobody remembers.

And the corners are the point. Incidents like this don't live in the systems you think about; they live in the ones you forgot. Human attention naturally flows to production, to the important accounts, to the apps in active use. The last mile here is everything outside that attention — and it is ownerless precisely because it is out of sight. An operator standing on the mile full-time, running enrollment and access reviews and decommissioning as routine rather than as a project, is what turns "the corners nobody remembers" into "the corners somebody checks."

For defenders

Five things you can check this week.

  1. Find every account without MFA — especially legacy, test, and service accounts. That list is your candidate footholds. Close it.
  2. Audit OAuth apps and service principals for elevated permissions, and revoke access that no longer matches a current purpose or owner.
  3. Give applications and test tenants a decommission date, and actually retire them.
  4. Tune detection for low-and-slow password spray, correlating small failure counts across accounts rather than waiting for volume.
  5. Put non-human identities under the same monitoring as humans — new consents, high-privilege grants, and app access to sensitive data should all alert.

Built from public reporting and the parties' own disclosures; sources below.

Sources

#microsoft #midnight-blizzard #oauth #legacy-identity #nhi #last-mile