According to Microsoft, the hackers behind the spying campaign are associated with a prolific hacker group named APT29 (also known as “Cozy Bear” and “Midnight Blizzard”) by cybersecurity researchers. It rose to infamy in 2020, when it was connected with the worldwide SolarWinds attack, which some experts described as possibly being among “the most impactful espionage campaigns on record”. It is believed that APT29 is closely associated with the Russian Foreign Intelligence Service (SVR, pictured).

Starting in late May 2023, APT29 hackers used several previously compromised Microsoft 365 accounts in order to set up internet domains with technical support-themed names. They then used these domains to contact a number of “highly targeted” individuals through Microsoft Teams, pretending to be Microsoft technical support representatives. Eventually, some of their targets were persuaded to provide the hackers with information they received through Microsoft’s multifactor authenticator system, thus granting them full access to their user accounts.

Microsoft did not disclose the identities of the targets, saying only that they were nearly 40 in number, and included government agencies, various multinational technology and manufacturing firms, media companies, as well as non-governmental organizations.