Threat Actor
Storm-0558
- First Reported
- Jul 21, 2023
- Latest Reported
- Jan 16, 2024
Reported Context (4)
- Threat actor described as stealing a Microsoft signing key and using forged authentication tokens to target accounts, including government email. Wiz Recaps Its 2023 Cloud Security Stories and Key Lessons
- Threat actor attributed to China; Microsoft concluded it most likely acquired an MSA signing key through a compromised engineer account and used forged authentication tokens to access Exchange and Outlook accounts. Wiz Examines Microsoft’s New Findings on Storm-0558 Signing-Key Theft
- China-based group assessed to have subverted Microsoft cloud controls and harvested information from government agencies. Identity Security Is Becoming a Third Pillar of Security Operations
- Microsoft attributed the incident to Storm-0558, which reportedly obtained an MSA signing key and used it to forge access tokens. Wiz Finds Storm-0558 Key Could Have Forged Tokens for More Microsoft Apps
CVE (7)
People (5)
Threat Actors (7)
MITRE ATT&CK (1)
Vendors (5)
Products (20)
Tools (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.