Microsoft Threat Intelligence researchers have observed the Russian nation-state threat group Midnight Blizzard conducting social engineering attacks over Microsoft Teams. In this latest campaign, Midnight Blizzard, otherwise known as NOBELIUM, APT29, and CozyBear, has been observed targeting approximately forty (40) global organizations within government, non-government organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors. Researchers explained that malicious activity involving this attack pattern began in May 2023 and consisted of Midnight Blizzard utilizing previously compromised Microsoft 365 tenants owned by small businesses. New domains were created using these tenants, which appeared as technical support operations, and used as lures by the threat group in Microsoft Teams messages. The lures were noted by researchers to “attempt to steal credentials from a targeted organization by engaging a user and eliciting approval of multifactor authentication (MFA) prompts.” CTIX analysts urge organizations to continually educate users on social engineering attack techniques and risks. Additional attack details as well as indicators of compromise (IOCs) can be viewed in the report linked below.