In May 2023 [3], a cyber-espionage group known as Storm-0558 [5], believed to be based in China, targeted Microsoft’s cloud-based Exchange email platform [3]. This breach resulted in the theft of sensitive information from senior officials at the State Department, raising concerns about the government’s reliance on a single vendor [5].
Description
The breach involved Storm-0558 exploiting a zero-day validation flaw to obtain a consumer signing key, allowing them to compromise Exchange Online and Azure Active Directory accounts [3]. By creating counterfeit signed access tokens [3], they were able to impersonate any account within their target organizations. The hackers also gained access to a comprehensive list of all State Department email addresses. Microsoft has since revoked the stolen signing key and is conducting an investigation [3], with no evidence of repeated unauthorized access using the same method [3].
As of May 15 [1], Storm-0558 had gained access to email accounts of approximately 25 organizations [1] [4], including government agencies [1] [2] [4]. The group first compromised a Microsoft engineer’s corporate account [1] [4], which provided access to a debugging environment containing a key used to sign security tokens and gain entry into accounts [1] [4].
The impact of the breach extended to high-ranking officials, including the US Ambassador to China [2], the Commerce Secretary [2], and the assistant secretary of State for East Asia [2]. However, the State Department has not commented on a Senate briefing regarding the hack [2]. Chinese officials have accused the US government of conducting cyberattacks against China in response to the breach [2].
Conclusion
This incident highlights the vulnerabilities that can be exploited by cyber-espionage campaigns and raises concerns about the government’s reliance on a single vendor. It emphasizes the need to strengthen defenses against cyberattacks and reconsider the government’s reliance on a single vendor [2]. Mitigations and future implications should be carefully considered to prevent similar breaches in the future.
References
[1] https://dnyuz.com/2023/09/28/chinese-communist-hackers-stole-60000-microsoft-managed-state-department-emails/
[2] https://www.cnn.com/2023/09/28/politics/china-hackers-state-department-emails-senate-briefing/index.html
[3] https://www.hackread.com/chinese-hackers-us-state-dept-emails-microsoft/
[4] https://www.theblaze.com/news/chinese-communist-hackers-stole-60000-microsoft-managed-state-department-emails
[5] https://www.infosecurity-magazine.com/news/microsoft-breach-60000-state/
