Incidents attributed to:

Storm-0558

Storm-0558 is a China-based threat actor with espionage objectives.

Storm-0558 is a China-based threat actor with espionage objectives. While there are some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), Microsoft maintain high confidence that Storm-0558 operates as its own distinct group

References

Actor metadata imported from Malpedia (Fraunhofer FKIE).

Related incidents

EspionageContainedMay 15, 2023

Microsoft Storm-0558 signing-key theft and US government email access (2023)

China-based Storm-0558 forged authentication tokens using a stolen Microsoft consumer signing key and read email at approximately 25 organisations — including the US State Department, the Department of Commerce, and the U.S. Ambassador to China. The 'cascade of errors' that enabled it became a defining case for cloud-provider key custody.

Victim: Microsoft customers (US State Department, Department of Commerce, ~25 organisations)