Loading story…
The U.S. Department of Homeland Security released a Cyber Safety Review Board report concluding that the Summer 2023 intrusion into Microsoft Exchange Online by Storm-0558, a threat group linked to the People’s Republic of China, was preventable and resulted from a cascade of Microsoft security failures. The breach affected 22 organizations and 503 individuals worldwide, including senior U.S. officials, and led to the theft of about 60,000 State Department emails. The board said Microsoft still does not know how the attackers obtained a critical signing key, rejected the company’s earlier crash-dump explanation as unproven, and faulted Microsoft for weak logging, delayed remediation, and failing to detect the intrusion itself.
The review said Microsoft’s operational and strategic decisions reflected a corporate culture that deprioritized enterprise security investment and rigorous risk management, and it called for direct CEO and board oversight of security, accountability for senior officers, and stronger protections across Microsoft’s cloud products. The report also issued broader recommendations for cloud providers and government, including stronger identity and authentication controls, default audit logging, improved disclosure and victim notification, and updates to federal cloud security frameworks; DHS said CISA will convene major cloud service providers to align on those practices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2024-05-03, Microsoft CEO Satya Nadella said security would become the company's top priority in response to the CSRB's findings on the Storm-0558 incident. He said Microsoft would expand its Secure Future Initiative across core security domains and tie security performance to hiring, rewards, and part of senior leadership compensation.
Alongside the report’s release, the board recommended stronger identity controls, default audit logging, better disclosure and victim notification, and updates to federal cloud security frameworks. DHS said CISA would convene major cloud service providers to align on security practices based on the report’s recommendations.
On 2024-04-02, DHS released the Cyber Safety Review Board’s report on the summer 2023 Microsoft Exchange Online intrusion. The board concluded the incident was preventable, criticized Microsoft’s security culture and operational decisions, and said the company still did not know how the attackers obtained the key.
In summer 2023, attackers attributed to Storm-0558 infiltrated Microsoft-hosted email accounts by abusing a signing key, affecting 22 organizations and 503 individuals worldwide. Victims included senior U.S. officials, and about 60,000 State Department emails were stolen.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
blogs.microsoft.com
Open sourcetechtarget.com
Open sourcetherecord.media
Open sourcedhs.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. Cyber Safety Review Board report sharply criticized Microsoft’s response to the **Storm-0558** intrusion that let China-linked attackers access Exchange Online mailboxes by forging authentication tokens with a stolen **Microsoft consumer signing key**. The campaign began in mid-May 2023 and affected more than **500 individuals across 22 organizations**, including senior U.S. government officials; attackers reportedly stole about **60,000 unclassified emails** from the U.S. Department of State over at least six weeks. The board said Microsoft still could not definitively explain how the key was obtained, despite earlier statements that tied the theft to crash dumps and a compromised engineer account associated with a prior 2021 intrusion. The review said Microsoft’s security failures worsened the breach, including retaining a **2016 signing key** that should have been revoked in 2021, relying on manual key rotation, and allowing an **OIDC/SDK token validation flaw** that let a consumer key sign tokens accepted for enterprise email accounts. The incident also exposed major visibility gaps because some customers lacked access to the logs needed to detect the intrusion; in response, Microsoft and **CISA** expanded access to critical logging, and Microsoft later extended default audit log retention while continuing its technical investigation into the key acquisition.
Aug 15, 2026
Attackers exploited multiple zero-day and later related vulnerabilities in on-premises Microsoft Exchange Server to compromise email systems at tens of thousands of organizations worldwide, including government agencies, banks, universities, defense contractors, law firms, healthcare entities, local governments, and small businesses. Microsoft initially attributed the early activity to the China-linked group **Hafnium**, while CISA, the FBI, and the White House warned that exploitation quickly spread to many additional state-backed and criminal actors after patches were released. The intrusions affected Exchange 2010, 2013, 2016, and 2019 deployments rather than Exchange Online or Microsoft 365, and enabled attackers to steal emails and address books, dump credentials, install **web shells** such as **China Chopper**, move laterally, and in some cases deploy follow-on malware including ransomware. U.S. and allied governments later formally attributed the campaign to actors affiliated with China’s Ministry of State Security, as CISA said organizations should investigate for compromise dating back to at least January 2021 and assume identity compromise where exploitation was found. Security researchers and incident responders reported thousands of backdoored servers across more than 100 countries, with many systems still unpatched well after disclosure, and warned that patching alone did not remove implanted persistence. Microsoft and CISA released emergency updates, detection and remediation guidance, and tools including `Test-ProxyLogon.ps1` and `EOMT.ps1`, while later research showed Exchange attack chains such as **ProxyShell** could still be adapted for remote code execution and could evade weak perimeter defenses, reinforcing that rapid patching and thorough incident response were essential.
Jun 29, 2026
Microsoft reported that **Storm-2949** used social engineering and abuse of Microsoft **Self-Service Password Reset (SSPR)** to compromise multiple **Microsoft Entra ID** accounts, including accounts tied to IT staff and senior leadership, then expanded access across **Microsoft 365** and **Azure**. After the initial identity takeover, the actor conducted tenant discovery through the **Microsoft Graph API**, exfiltrated data from **OneDrive** and **SharePoint**, and sought persistence by re-registering MFA methods and attempting to abuse service principal credentials. The intrusion then moved deeper into Azure, where Storm-2949 relied on legitimate management-plane operations and privileged **Azure RBAC** roles to access **App Services**, **Key Vault**, **SQL databases**, **Storage accounts**, and **virtual machines**. Microsoft said the actor used publish profiles, Key Vault permission changes, SQL firewall rule modifications, storage key listing, **VMAccess**, and **Run Command** to harvest credentials, execute code, deploy **ScreenConnect** on VMs, weaken Microsoft Defender Antivirus, and exfiltrate large volumes of data while blending into normal administrative activity; the group also cleared event logs and deleted artifacts to hinder detection.
Jun 29, 2026