The government network is hardened. So APT29 goes through the IT vendor with admin access to ten government environments simultaneously.
This is the SolarWinds logic applied persistently, and it works. APT29, Russia’s SVR tracked by Microsoft as Midnight Blizzard, has shifted the weight of its UK and European government targeting toward software vendors, IT service providers, and cloud management companies that hold privileged access to government systems. Compromising the supplier gives access to the government client without ever directly attacking a government network.
The Three Techniques Defining Current Operations
OAuth application abuse is the most technically distinctive element. APT29 is registering or compromising OAuth applications with excessive Microsoft Graph permissions in the Entra ID tenants of IT service providers. A third-party OAuth app with Mail.ReadWrite and full_access_as_app grants doesn’t need to bypass MFA; the token itself is the access. Credential-based controls don’t touch it. This is an attack surface that most organisations’ security programmes are not designed to address.
Dormant account reactivation targets former employees of government IT suppliers whose cloud directory accounts remain active after they leave. A dormant account with legacy permissions is a lower-profile initial access point than compromising a current employee, with less monitoring and often no active user to notice suspicious sign-in behaviour. Standard offboarding practice should eliminate this exposure. It frequently doesn’t.
Residential proxy routing obscures the geographic and ISP patterns that would otherwise flag suspicious access. Legitimate-looking IP addresses from residential infrastructure blend with normal administrator logins. The same operational security pattern Volt Typhoon uses. It works because detection logic is often built around ASN and geographic anomalies, not behaviour.
What the Microsoft Email Compromise Actually Meant
The January 2024 disclosure (that APT29 had accessed Microsoft senior leadership email accounts) was notable for what APT29 was looking for. Not product source code. Not customer data. Correspondence about what Microsoft knew about APT29. It was a counter-intelligence operation: using corporate email as the collection mechanism to understand Microsoft’s detection capability and its coordination with law enforcement.
That has specific implications for UK government. Departments that rely on Microsoft 365 and that have worked with NCSC or law enforcement on APT29-related activity should treat their post-January 2024 communications as potentially compromised. Not certainly compromised. But the question should have been asked, and in many organisations it hasn’t been.
Controls That Matter
OAuth application audit. Pull the list of third-party apps with Microsoft Graph permissions in your Entra ID tenant. Look specifically for any application with mail read, write, or full_access_as_app grants that was not explicitly provisioned through a controlled process. This is not a theoretical exercise; it is the primary unmonitored attack surface in current APT29 operations.
Disable dormant supplier accounts. Former contractor and service provider accounts that retain directory presence are a gift. Build offboarding hygiene that catches them before threat actors do.
Conditional Access for service account sign-ins. OAuth application sign-ins from unexpected locations or routing through proxy infrastructure are identifiable. Conditional Access policies can flag or block these. Most organisations have Conditional Access for users; service account coverage is patchier.
Enhanced audit logging for Entra ID sign-in events, OAuth grant activity, and application consent is the detection foundation for APT29 cloud operations. Without it, you’re not looking.