Incident: A retired key that still signed in

Module 6 · Incident file · About 35 minutes

What happened

In May and June 2023 a threat actor Microsoft calls Storm-0558 read the Exchange Online mailboxes of 22 organisations and 503 related personal accounts. It "accessed the accounts using authentication tokens that were signed by a key Microsoft had created in 2016". The account here comes from the US Cyber Safety Review Board's report of 20 March 2024 (CSRB, "Review of the Summer 2023 Microsoft Exchange Online Intrusion"). As of that report, Microsoft did not know how or when the actor obtained the key.

The victims included the US Commerce Secretary, the US Ambassador to China and a member of Congress, and organisations in the UK. The actor had access to some mailboxes "for at least six weeks" and downloaded about 60,000 emails from the State Department alone. Microsoft did not find the intrusion. State did, on 15 and 16 June 2023, with a custom alert on a mailbox access log. On 24 June Microsoft invalidated the stolen key. The Board's verdict: "this intrusion was preventable and should never have occurred."