Chinese hackers infiltrate email accounts of several organizations, claims Microsoft

Microsoft has alleged that hackers originating from China have intruded upon the email accounts of nearly 25 organizations. Among these organizations are undisclosed government agencies. The cyberattacks have been tied to an entity known as Storm-0558, a cyber-espionage group with a reported specialty in infiltrating email networks to gather sensitive data. The specific locations of the affected organizations, however, remain undisclosed by the tech giant.

A closer look into the attacks

Microsoft's investigation into the alleged cyber-attacks began on June 16, 2023, following user complaints concerning unusual activity within their Office 365 mailboxes. The company found that the illicit access to customer accounts traced back to May 15, 2023, with the suspected actors being Storm-0558. The affected accounts appear to have been linked to approximately 25 organizations, with the U.S. State and Commerce Departments among them.

Responses and repercussions of the security breach

Despite these allegations, Microsoft has not named the specific businesses, government institutions, or countries directly impacted by these email security incidents. In a response to these claims, the Chinese embassy in London labeled the U.S. government as "the world's largest hacking empire and a global cyber thief," dismissing Microsoft's assertions as "disinformation." As has been the pattern, China consistently denies any participation in hacking activities, regardless of the provided evidence or context.

Breach of Microsoft's Cloud security and method of attack

Adam Hodge, a spokesman for the White House National Security Council, stated that the breach in Microsoft's cloud security impacted "unclassified systems," though further details were not provided. According to Microsoft's analysis, the hacking group Storm-0558 utilized Outlook Web Access in Exchange Online (OWA) and Outlook.com to access user accounts by forging authentication tokens. The hackers allegedly acquired a Microsoft consumer signing key and used a token validation vulnerability to pose as Azure AD users and access corporate email accounts. Microsoft only discovered Storm-0558's malicious activities when users alerted the company about suspicious email activity, which had gone undetected for about a month.