Mitiga at RSAC 2025: Visit our booth, attend our speaking sessions, and schedule a meeting with us!

In an ever-changing cyber landscape, the recent exploit by China-based threat actor, Storm-0558, highlights the need for constant vigilance. The threat actor exploited a compromised encryption key (MSA key) to target Microsoft Exchange Online, forge access tokens, manipulate the token verification process, and extract unclassified data from victim mailboxes.

A Mitiga, we build a cloud and SaaS Forensic Data Lake for customers so that they are prepared in moments like this one. By having the historic forensic data ready and available for investigation, we were able to quickly hunt for indicators of this type of attack including seeking out IP addresses used to access user emails with a forged authentication token or as part of supporting infrastructure. Taking this kind of proactive approach ensures we have a complete hunting ground to root out assailants and enables a rapid response—allowing us to secure our clients' environments thoroughly and quickly.

Where Cloud and SaaS are concerned, this should be the new standard.

Remember that concealment is the mode of operation for these espionage attacks. The pressing issue, therefore, is not only whether you are susceptible to this type of attack, but, more importantly, whether an attacker has already breached your environment and is currently operating within it. At Mitiga, we provide our clients with the reassurance that their environment is secure, even when hidden dangers are present.

Stay Informed. Stay vigilant.

If you want to learn more about how your enterprise could be strengthening your preparedness to be ready for these types of exploits, contact us.

LAST UPDATED:

November 7, 2024

Don't miss these stories:

Who Touched My GCP Project? Understanding the Principal Part in Cloud Audit Logs – Part 2

This second part of the blog series continues the path to understanding principals and identities in Google Cloud Platform (GCP) Audit Logs. Part one introduced core concepts around GCP logging, the different identity types, service accounts, authentication methods, and impersonation.

Make Cloud Attacks Yesterday’s Problem with Mitiga at RSA Conference 2025

Visit Mitiga at booth number N-4618 at RSA Conference 2025 to learn about cloud detection and response.

Mitiga Cooperates with Law Enforcement on a Global BEC

Mitiga has worked with a law enforcement investigation to prevent criminals from impersonating Office 365 executives and redirecting wire transfers. Learn more.

How Missing Logs Impact Cloud Security

Microsoft experienced an issue with internal monitoring agents, resulting in incomplete logs for some services. Get more details and recommended next steps.

Unlocking Cloud Security with Managed Detection and Response

See how Mitiga’s Cloud Managed Detection and Response tackles complex cyber threats with proactive threat management and advanced automation at scale.

Mitiga Cloud Managed Detection and Response (C-MDR) Reduces Alert Fatigue and Bolsters SecOps Resources

Learn about Mitiga’s fully-managed cloud detection and response service that operates 24/7.