Microsoft was tipped off on the existence of Storm-0558’s latest campaign by none other than the US State Department, whose emails were allegedly accessed by the Chinese threat actor.
Earlier this week, it was reported that a Chinese threat actor accessed more than two dozen email accounts belonging to different organizations in the West, including government firms. Microsoft attributed the attack to Storm-0558, a group known for espionage and data theft.
Now we know that Microsoft discovered the intrusion only after the Federal Civilian Executive Branch (FCEB) agency sounded the alarm, and a month after the Chinese made their way into the inboxes and apparently stole.
Abusing Outlook Web Access in Exchange Online
"In June 2023, a Federal Civilian Executive Branch (FCEB) agency identified suspicious activity in their Microsoft 365 (M365) cloud environment," a joint cybersecurity advisory released by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) says. "Microsoft determined that advanced persistent threat (APT) actors accessed and exfiltrated unclassified Exchange Online Outlook data."
The attack was conducted using forget authentication tokens which allowed threat actors to access emails using an acquired MIcrosoft account consumer signing key, the company confirmed.
“Microsoft investigations determined that Storm-0558 gained access to customer email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com by forging authentication tokens to access user email,” Microsoft explained.
“The actor used an acquired MSA key to forge tokens to access OWA and Outlook.com. MSA (consumer) keys and Azure AD (enterprise) keys are issued and managed from separate systems and should only be valid for their respective systems. The actor exploited a token validation issue to impersonate Azure AD users and gain access to enterprise mail. We have no indications that Azure AD keys or any other MSA keys were used by this actor. OWA and Outlook.com are the only services where we have observed the actor using tokens forged with the acquired MSA key.”
China denied any wrongdoing, The Hacker News further reports, flipping the script on the United States and calling the country "the world's biggest hacking empire and global cyber thief." The Chinese added it was "high time that the U.S. explained its cyber attack activities and stopped spreading disinformation to deflect public attention."
Storm-0558 apparently used two malware, Bling and Cigril, with the latter being described as a trojan capable of decrypting encrypted files and running them directly from system memory on the target endpoint.
- Here's our list of the best malware removal tools around
Via: The Hacker News
