Microsoft folds Storm-2372 into Midnight Blizzard 17 months after first naming it

A device code exists for hardware that cannot open a browser, so the person signs in on a second device and types a short code to finish the authentication ^[7]. Storm-2372 generated the code itself and delivered it inside what looked like a Microsoft Teams meeting invitation; when the target completed the sign-in, the actor collected the valid access token and the authenticated session with it ^[5]. Microsoft wrote that the tokens "are part of an industry standard" and that it has not "found any vulnerabilities in our code base enabling this activity" ^[6]. That leaves nothing to patch. The decision is a configuration one: whether the flow is permitted in the tenant, and for which clients.

Blocking specific client IDs is easy to evade, and a blocklist written against the application identities seen in one week has to be maintained at that pace. One day after the February 13, 2025 post, Microsoft reported observing the actors move to the specific client ID for Microsoft Authentication Broker in the device code sign-in flow ^[2][8][11].

Microsoft's Storm numbers are provisional by design. The company uses them for an unknown, emerging or developing cluster until it reaches high confidence about the origin or identity behind the activity ^[9]. The July 31, 2026 update keeps the number and places the cluster inside Midnight Blizzard as a sub-cluster of initial access operations, on the basis of technical and operational overlaps ^[1]. It gives no confidence level for the assessment and does not describe Midnight Blizzard's sponsorship ^[10]. The moderate-confidence language about Russian interests, victimology and tradecraft attaches to the original reading of Storm-2372 ^[3].

The dates matter to anyone re-reading an old ticket. Activity dates to August 2024 and the disclosure to February 13, 2025, about six months later ^[4][8][12], and the attribution update landed roughly 17 months after the post ^[11].

The update changes the assumed consequence of one stolen token. "Initial access operations" is Microsoft's own description of a group whose output is entry into environments, and the technique can hold that entry for as long as the tokens stay valid ^[1][13]. An incident closed in 2025 as credential theft was scoped against Storm-2372 before Microsoft placed it inside Midnight Blizzard.

Microsoft said its Threat Intelligence Center continues to track campaigns launched by Storm-2372 and, when able, directly notifies customers who have been targeted or compromised ^[14].