Microsoft says Russian state-sponsored hackers spied on its executives

Contradictions:

"This attack does highlight the continued risk posed to all organizations from well-resourced nation-state threat actors like Midnight Blizzard," the company said, noting that the attack was not the result of a specific vulnerability in it products or services."

Yet:

"The company said the hackers used a "password spray attack" starting in Nov. 2023 to breach a Microsoft platform. Hackers use this technique to infiltrate a company's systems by using the same compromised password against multiple related accounts."

How password spray works if 2FA is used? MS employees are not required to use 2FA?

Traditional spraying shouldn't be possible with 2FA, but SMS can be spoofed, etc.

Dupe: https://news.ycombinator.com/item?id=39061800

Now if only Microsoft would quit spying on its users..