Analysis of Storm-0558 techniques for unauthorized email access

Executive summary

On July 11, 2023, Microsoft published two blogs detailing a malicious campaign by a threat actor tracked as Storm-0558 that targeted customer email that we’ve detected and mitigated: Microsoft Security Response Center and Microsoft on the Issues. As we continue our investigation into this incident and deploy defense in depth measures to harden all systems involved, we’re providing this deeper analysis of the observed actor techniques for obtaining unauthorized access to email data, tools, and unique infrastructure …

access actor analysis blogs campaign center continue customer defense defense in depth deploy email executive incident in depth investigation july malicious microsoft microsoft security response security storm-0558 techniques threat threat actor