Storm-0558 - Compromised Engineer Account → Stolen MSA Signing Key → Forged Tokens → Government Email Espionage
Chinese nation-state actor Storm-0558 obtained a consumer Microsoft Account (MSA) signing key and used it to forge authentication tokens. Microsoft first said the key had most probably leaked in a crash dump reached through a compromised engineer's corporate account; in March 2024 it said it had not found a crash dump containing the key, and the Cyber Safety Review Board concluded that Microsoft does not know how or when the key was obtained. A token validation bug in Exchange Online accepted these consumer tokens as enterprise credentials, enabling access to ~25 organisations' email, including 60,000 US State Department emails, for weeks before discovery.
Disclosure: research published by Wiz is one of the sources cited on this page, and the site's author works at Wiz. Every source is linked so you can read it directly.
📄 MSRC July 2023 ↗ 📄 MSRC key acquisition investigation ↗ 📄 Wiz Research analysis ↗Microsoft told the Cyber Safety Review Board it believes Storm-0558 compromised an engineer's device before Microsoft acquired the engineer's employer, Affirmed Networks, in 2020. After the acquisition the engineer was given Microsoft corporate credentials on that device, and the actor captured and replayed a token to reach Microsoft's corporate network, a compromise Microsoft dates to between April and August 2021. Microsoft believes, although it has produced no specific evidence, that this 2021 intrusion was likely connected to the 2023 Exchange Online compromise.
Log retention gap: Microsoft could not confirm exfiltration due to log retention policy limits
Microsoft's September 2023 investigation said a 2021 crash of the consumer signing system had most probably produced a crash dump containing the key, that the dump was moved to a debugging environment, and that Storm-0558 reached it through the compromised engineer's account. In March 2024 Microsoft added that it had not found a crash dump containing the key, and that the race condition it had described affected whether a dump could be removed from the signing environment, not whether the key could be in it. The Cyber Safety Review Board concluded that Microsoft does not know how or when Storm-0558 obtained the key. Microsoft's leading hypothesis remains that operational errors let key material leave the secure token signing environment, and that it was later accessed in a debugging environment through a compromised engineering account.
How it leaked: Unknown; the crash dump explanation was withdrawn in March 2024
Microsoft's hypothesis: Operational errors let key material out; accessed in a debugging environment via a compromised engineering account
Microsoft quote: "Operational errors resulted in key material leaving the secure token signing environment"
Starting May 15, 2023, Storm-0558 used the stolen MSA consumer signing key to forge OpenID v2.0 access tokens impersonating specific users at targeted government organisations. The tokens were correctly signed, which means any service validating them against Microsoft's published public keys would accept them as legitimate.
Blast radius (per Wiz): Could forge tokens for any Azure AD app supporting personal account auth - not just Exchange
Services potentially at risk: OneDrive, SharePoint, Teams, any app using "Login with Microsoft"
Consumer and enterprise signing keys are separate systems and should only be valid for their respective scopes. However, the Azure AD SDK did not validate token issuers by default, and the Exchange Online team had incorrectly assumed it did. This meant Exchange Online accepted the forged consumer-scoped tokens as valid enterprise credentials. An additional OWA GetAccessTokenForResource API bug let attackers generate fresh Exchange tokens from forged tokens.
OWA additional bug: GetAccessTokenForResource API issued fresh tokens from already-issued forged tokens
Result: Consumer MSA token → accepted as enterprise Exchange Online credential
Using PowerShell and Python scripts against the OWA REST API with forged tokens, Storm-0558 read and exfiltrated email from ~25 organisations including senior US State Department and Commerce Department officials. Access ran for at least 6 weeks before discovery.
State Dept loss: ~60,000 emails including communications of the US Ambassador to China
Other victims: Commerce Secretary Raimondo + senior officials across ~25 organisations
The State Dept detected the breach via a custom alert rule triggered by the MailItemsAccessed audit event, which was only available to organisations that had purchased Microsoft's E5 license tier. Organisations on lower tiers could not see this event and were unable to detect the breach independently. Following CISA pressure, Microsoft extended MailItemsAccessed to E3 customers in September 2023.
Critical licensing gap: MailItemsAccessed was E5-only at time of breach · Most victims couldn't see it
Dwell time: ~6 weeks of confirmed email access; potentially 2 months total