ClosedCriticalPatched
Day · Jul 11, 2023
Storm-0558: stolen Microsoft signing key used to read government email
Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)
Updates on Jul 11, 2023
Microsoft discloses the intrusion; CISA and FBI publish AA23-193A
Source
Summary
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.
Read the full incident →Advisories3
- Microsoft mitigates China-based threat actor Storm-0558 targeting of customer emailMicrosoft · Jul 11, 2023
- Results of Major Technical Investigations for Storm-0558 Key AcquisitionMicrosoft · Sep 6, 2023
- Enhanced Monitoring to Detect APT Activity Targeting Outlook Online (AA23-193A)CISA · Jul 12, 2023
