Storm-0558: stolen Microsoft signing key used to read government email ยท updates https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump. en Wed, 06 Sep 2023 00:00:00 GMT Storm-0558: stolen Microsoft signing key used to read government email: Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-09-06-5710979f Wed, 06 Sep 2023 00:00:00 GMT critical <p><a href="https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/">Source</a></p> Storm-0558: stolen Microsoft signing key used to read government email: Microsoft details how the stolen MSA key was used to forge tokens https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-07-14-5952b64e Fri, 14 Jul 2023 00:00:00 GMT critical <p><a href="https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/">Source</a></p> Storm-0558: stolen Microsoft signing key used to read government email: Microsoft discloses the intrusion; CISA and FBI publish AA23-193A https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-07-11-48fafade Tue, 11 Jul 2023 00:00:00 GMT critical <p><a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a">Source</a></p> Storm-0558: stolen Microsoft signing key used to read government email: Microsoft opens an investigation after a customer reports anomalous mail access https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-06-16-f5d2dfe3 Fri, 16 Jun 2023 00:00:00 GMT critical <p><a href="https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/">Source</a></p> Storm-0558: stolen Microsoft signing key used to read government email: Storm-0558 begins accessing customer email with forged tokens https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023 https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023#2023-05-15-c7a5fb48 Mon, 15 May 2023 00:00:00 GMT critical <p><a href="https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/">Source</a></p>