Storm-0558: stolen Microsoft signing key used to read government email
Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.
Why this severity: Cloud identity compromise of a hyperscaler signing key
- Started
- May 15, 2023
- Closed
- Sep 6, 2023
Affected
Not published yet
Fixed in
No fixed release yet
Updates by day5
▸Sep 6, 2023
Link #Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network
Source
▸Jul 14, 2023
Link #Microsoft details how the stolen MSA key was used to forge tokens
Source
▸Jul 11, 2023
Link #Microsoft discloses the intrusion; CISA and FBI publish AA23-193A
Source
▸Jun 16, 2023
Link #Microsoft opens an investigation after a customer reports anomalous mail access
Source
▸May 15, 2023
Link #Storm-0558 begins accessing customer email with forged tokens
Source
Advisories3
- Microsoft mitigates China-based threat actor Storm-0558 targeting of customer emailMicrosoft · Jul 11, 2023
- Results of Major Technical Investigations for Storm-0558 Key AcquisitionMicrosoft · Sep 6, 2023
- Enhanced Monitoring to Detect APT Activity Targeting Outlook Online (AA23-193A)CISA · Jul 12, 2023
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
