I’ve been reading through the TeamViewer breach disclosures and the subsequent security updates from the company. The attack was attributed to Midnight Blizzard — a Russia-linked state actor — and the entry point was a compromised employee account.

TeamViewer has since said it has strengthened its authentication procedures. Worth unpacking why that line matters more than it sounds.

What is a password spray?

Midnight Blizzard is well-known for password spraying — and it’s a technique that’s distinctly different from the more familiar “credential stuffing” or “brute force”:

  • Brute force tries many passwords against one account
  • Credential stuffing uses leaked email-password pairs against many accounts
  • Password spraying tries a small list of common passwords (think Spring2024!, Welcome123) against many accounts, slowly enough to avoid lockouts

Why it works: in a large organisation, statistically someone is using a guessable password. The attacker doesn’t need to crack a specific person — they just need to find the one weak link in a directory of thousands.

The defence isn’t password complexity rules. It’s MFA.

Why MFA presence isn’t enough

If TeamViewer needed to strengthen authentication after the incident, the more honest read is that whatever MFA they had wasn’t sufficient for this employee — either it wasn’t enforced, had exceptions, used weak factors, or wasn’t required for the access path the attacker took.

This is the gap that doesn’t show up in security questionnaires. The questions usually ask “do you have MFA?” — not:

  • Is it enforced everywhere? Including legacy protocols, service accounts, admin consoles, and the seams between systems?
  • Is it phishing-resistant? SMS and TOTP can be intercepted or relayed. Hardware keys and passkeys cannot.
  • Are there bypass paths? Recovery flows, “trusted device” exemptions, legacy SSO integrations — every one of these is a potential gap.
  • Does it apply to the attacker’s preferred entry points? Specifically the ones state actors know how to find.

A “yes” to MFA on paper can hide a “no” in the place that matters.

The pattern Midnight Blizzard exploits

Midnight Blizzard is patient and operationally sophisticated. They don’t rush. Their playbook reliably finds the one corner of an environment where identity controls don’t hold up to scrutiny.

That’s the discipline this incident points to: identity management isn’t a control you implement once and check off. It’s a continuous audit of where the policy doesn’t reach. The exceptions are where breaches live.

Weak passwords or incomplete MFA aren’t theoretical risks anymore. They’re an open door — and password spraying is the cheapest way for a sophisticated actor to find it.

Sources: