Loading story…
A U.S. Cyber Safety Review Board report sharply criticized Microsoft’s response to the Storm-0558 intrusion that let China-linked attackers access Exchange Online mailboxes by forging authentication tokens with a stolen Microsoft consumer signing key. The campaign began in mid-May 2023 and affected more than 500 individuals across 22 organizations, including senior U.S. government officials; attackers reportedly stole about 60,000 unclassified emails from the U.S. Department of State over at least six weeks. The board said Microsoft still could not definitively explain how the key was obtained, despite earlier statements that tied the theft to crash dumps and a compromised engineer account associated with a prior 2021 intrusion.
The review said Microsoft’s security failures worsened the breach, including retaining a 2016 signing key that should have been revoked in 2021, relying on manual key rotation, and allowing an OIDC/SDK token validation flaw that let a consumer key sign tokens accepted for enterprise email accounts. The incident also exposed major visibility gaps because some customers lacked access to the logs needed to detect the intrusion; in response, Microsoft and CISA expanded access to critical logging, and Microsoft later extended default audit log retention while continuing its technical investigation into the key acquisition.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
In April 2024, the Department of Homeland Security's Cyber Safety Review Board issued a report sharply criticizing Microsoft's handling of the 2023 Exchange Online intrusion. The report said Microsoft still lacked definitive evidence for how the signing key was stolen and highlighted security, logging, and process failures.
On March 12, 2024, Microsoft revised its earlier statement that Storm-0558 likely obtained the key from crash dumps, clarifying that this was only a theory unsupported by evidence. The change came after pressure from the CSRB, according to the report.
In February 2024, Microsoft expanded the default Purview Audit standard log retention period from 90 days to 180 days and provided additional telemetry to federal agencies. This followed work with CISA to make critical logging more broadly available for detecting similar attacks.
In September 2023, Microsoft published results of its technical investigation into how Storm-0558 acquired the signing key. Microsoft said at the time that the actor likely obtained the key from crash dumps.
The U.S. Department of State alerted Microsoft to the intrusion on June 16, 2023. The incident ultimately led to disclosure that about 60,000 unclassified State Department emails were stolen over at least six weeks.
On June 15, 2023, the U.S. Department of State's security operations center observed anomalous access on its mail systems. It detected multiple alerts using a custom 'Big Yellow Taxi' rule based on MailItemsAccessed logs.
Beginning in mid-May 2023, Storm-0558 used forged authentication tokens signed with the 2016 consumer key to access Exchange Online email accounts. The campaign ultimately affected more than 500 individuals across 22 organizations.
A Microsoft Services Account consumer signing key created in 2016 should have been revoked in March 2021. The CSRB found that Microsoft's manual consumer key rotation process and lack of alerts left the old key active.
Microsoft investigated a theory that a 2021 compromise of its corporate network through an engineer's account led to the later theft of the signing key. The CSRB said Microsoft did not produce evidence supporting that theory.
Microsoft acquired Affirmed Networks in 2020. Microsoft later theorized that an engineer device involved in a 2021 compromise had already been compromised before the acquisition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcemsrc.microsoft.com
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Department of Homeland Security released a Cyber Safety Review Board report concluding that the Summer 2023 intrusion into Microsoft Exchange Online by **Storm-0558**, a threat group linked to the People’s Republic of China, was preventable and resulted from a cascade of Microsoft security failures. The breach affected **22 organizations** and **503 individuals** worldwide, including senior U.S. officials, and led to the theft of about **60,000 State Department emails**. The board said Microsoft still does not know how the attackers obtained a critical signing key, rejected the company’s earlier crash-dump explanation as unproven, and faulted Microsoft for weak logging, delayed remediation, and failing to detect the intrusion itself. The review said Microsoft’s operational and strategic decisions reflected a corporate culture that deprioritized enterprise security investment and rigorous risk management, and it called for direct CEO and board oversight of security, accountability for senior officers, and stronger protections across Microsoft’s cloud products. The report also issued broader recommendations for cloud providers and government, including stronger identity and authentication controls, default audit logging, improved disclosure and victim notification, and updates to federal cloud security frameworks; DHS said CISA will convene major cloud service providers to align on those practices.
Jun 29, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026