A Chinese threat actor was able gain access to more than two dozen Microsoft email accounts belonging to various organizations in the West, the company has revealed.
Microsoft explained the details in an advisory published on the company’s website, noting it spotted the threat actor it tracks as Storm-0558 targeting government agencies in Western Europe, after being tipped off by customers in mid-June.
A deeper investigation uncovered that Storm-0558 started its campaign in mid-May this year, gaining access to email accounts of roughly 25 organizations, including government firms.
Forging authentication tokens
The attack was conducted using forget authentication tokens which allowed threat actors to access emails using an acquired MIcrosoft account consumer signing key, the company confirmed.
“Microsoft investigations determined that Storm-0558 gained access to customer email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com by forging authentication tokens to access user email,” Microsoft explained.
“The actor used an acquired MSA key to forge tokens to access OWA and Outlook.com. MSA (consumer) keys and Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems. The actor exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. We have no indications that Azure AD keys or any other MSA keys were used by this actor. OWA and Outlook.com are the only services where we have observed the actor using tokens forged with the acquired MSA key.”
Microsoft’s post-activity telemetry suggests that the attack was successfully mitigated, and that Storm-0558 no longer has access to these accounts. However, the company did not discuss the damage that was done in the month while the attackers had access.
What it did confirm is that the group is usually focused on espionage, data theft, and credential access, against entities in Western Europe.
There is nothing for potentially affected customers to do in order to stay secure, Microsoft added, as the update was done from the company’s side. The Redmond software giant said it contacted targeted firms directly, and provided them with important information needed for mitigation and response.
“If you have not been contacted, our investigations indicate that you have not been impacted,” Microsoft concluded.
- Here’s our list of the best malware removal tools around