how it happened
- whoAPT29password spraying
- the gaptest account, no MFAforgotten
- thenelevated grantinto corporate email
- the resultleadership mailboxesread for weeks
what everyone assumed
Test and legacy tenants feel disposable, walled off from anything that matters, exempt from the controls that guard production. The assumption is that a non-production account is a non-consequential account.
what happened
From the legacy tenant the attackers found a legacy OAuth application that, against expectation, held elevated access into the corporate environment. That standing grant let them read email across senior leadership, security, and legal, slowly and quietly, for weeks.
step by step
- a legacy test account has no MFAThe attackers get in there.
- a forgotten OAuth app holds elevated accessIt reaches into the corporate environment.the assumption breaks here
- weeks of reading emailSenior leadership, security and legal mailboxes.
- January 2024Microsoft disclosesAttributed to APT29.
how it surfaced
In January 2024 Microsoft disclosed that the nation-state group APT29 had read corporate email from a small percentage of mailboxes, including senior staff, after entering through a no-MFA legacy test account and a forgotten OAuth app.
A retired environment is only harmless if its access retired with it.
A test tenant with a live OAuth grant into production is a production risk wearing a test label.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersAn attacker guesses the test account's password and finds the app.what it costs youThey read your leadership's email for weeks through a setup everyone forgot.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
sources
your turn
what you can do about it
this week
List old test tenants, legacy apps and OAuth grants, and what each can reach.
You have test tenants, legacy apps, and old OAuth grants nobody has looked at since they were created. Some of them quietly reach into systems that matter. The inventory of forgotten grants and their scopes is exactly the surface Midnight Blizzard used, and it is yours to read.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →