The Power of Audit Logs: Critical Lessons from the Recent Storm-0558 Threat

Originally published by Obsidian Security on July 25, 2023. Earlier this month, Microsoft and CISA reported the discovery of a recent advanced persistent threat (APT), Storm-0558, which gained access to Exchange and harvested corporate emails. The threat actor group responsible managed to gain access to exchange data via Outlook Web Access (OWA) API, using an access token obtained by exploiting vulnerabilities in the Microsoft ecosystem related to token exchange and signature validation. They...

access actor advanced advanced persistent threat apt audit cisa corporate critical data discovery emails exchange july logs managed microsoft obsidian obsidian security persistent persistent threat power responsible security storm storm-0558 threat threat actor