State sponsored espionage

Storm-0558

Also tracked as Antique Typhoon

Storm-0558, now tracked by Microsoft as Antique Typhoon, is a China based espionage group. In 2023 it forged authentication tokens using an acquired Microsoft signing key. It used the forged tokens to read email from about 25 organizations through Outlook Web Access.

Cloud tradecraft

Forges Azure AD and consumer tokens with an acquired signing key
Replays forged tokens to access Exchange Online and OWA
Steals and refreshes application access tokens to stay authenticated
Uses OWA REST APIs to download targeted mailboxes and attachments

MITRE ATT&CK techniques

T1606 T1550.001 T1528 T1078.004 T1114.002

References

Analysis of Storm-0558 techniques for unauthorized email access
Microsoft mitigates China-based threat actor Storm-0558 targeting of customer email
Results of Major Technical Investigations for Storm-0558 Key Acquisition

Prevent these techniques in your AWS accounts

Pathbreak validates which of these techniques resolve against your real AWS authorization and gives you the change that breaks each path, so an attacker cannot chain it.

Request a free scan Browse the attack map