Skip to content
Start with Identity
Join free
Threat actor · Nation-state

Storm-0558 identity breaches

Storm-0558 is the name Microsoft Threat Intelligence uses for an actor it assesses with moderate confidence to be China-based, with activity consistent with espionage objectives. MITRE ATT&CK has no group entry for it as of November 2026. Beginning May 15, 2023, the actor used an acquired, inactive Microsoft account (MSA) consumer signing key to forge authentication tokens and read email through Outlook Web Access and Exchange Online at approximately 25 organizations, including government agencies. Microsoft attributed the reach of the forged tokens to a validation issue that let the consumer key be trusted for signing Azure AD tokens, which it has since corrected. The US Cyber Safety Review Board later reviewed the intrusion. In this database it is the clearest case of an attack on a token issuer itself rather than on any user's credentials.

Also tracked as
No other public names
Origin (as attributed)
China-based, assessed with moderate confidence by Microsoft Threat Intelligence
MITRE ATT&CK
No group entry
Profile verified
Nov 5, 2026
1
incident in the database, disclosed 2023
0 / 0
MFA bypassed / not enforced (1 not applicable or undisclosed)
100%
began with identity infrastructure vulnerability
1 / 0
human / non-human identity abused

Incidents attributed to Storm-0558

Records whose sources attribute the intrusion to this group or one of its tracked names, newest disclosure first. Each record links its primary sources.

Browse the full database

Identity controls that failed

How to defend against Storm-0558

One control per initial access vector seen in this group's records, most frequent first. The identity lesson on each incident page gives the case-specific detail.

  1. Identity infrastructure vulnerability (1 of 1): Patch identity infrastructure first. Token issuers must protect signing keys, rotate them, and validate issuer, audience and key scope on every token they accept. See JWKS and PKI.

Sources

  1. Analysis of Storm-0558 techniques for unauthorized email access (Microsoft Threat Intelligence, 2023-07-14)
  2. Results of major technical investigations for Storm-0558 key acquisition (Microsoft Security Response Center)
  3. CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion (Cyber Safety Review Board)

Profile verified Nov 5, 2026 against the sources above. Incident attributions come from each record's own sources. Corrections: contact us.

Frequently asked questions

Which breaches has Storm-0558 been linked to?
The Identity Breach Database attributes 1 identity breach disclosed 2023 to Storm-0558: Storm-0558 forged Microsoft tokens to read Exchange Online mail (2023). Attribution follows each record's sources; where the actor name is only claimed, the record says so.
How does Storm-0558 get initial access?
Across its 1 record, the initial access vectors were identity infrastructure vulnerability (1). The identity control that failed most often was directory and trust (1 of 1).
Did MFA stop Storm-0558?
In 0 of 1 incidents MFA was present and bypassed, and in 0 it was not enforced on the abused account. In the remaining 1, MFA was not applicable (no interactive login, such as a stolen key or token) or its status was not disclosed. Every incident abused a human account.

Cite this page

SWI Community Team. (2026). Storm-0558 identity breaches. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/actors/storm-0558/

Part of the Identity Breach Database, free to reuse under CC BY 4.0. See all threat actors.