Microsoft Storm-0558 SaaS Breach: Hunting for Stealth Espionage Attacks

In an ever-changing cyber landscape, the recent exploit by China-based threat actor, Storm-0558, highlights the need for constant vigilance. The threat actor exploited a compromised encryption key (MSA key) to target Microsoft Exchange Online, forge access tokens, manipulate the token verification process, and extract unclassified data from victim mailboxes.

A Mitiga, we build a cloud and SaaS Forensic Data Lake for customers so that they are prepared in moments like this one. By having the historic forensic data ready and available for investigation, we were able to quickly hunt for indicators of this type of attack including seeking out IP addresses used to access user emails with a forged authentication token or as part of supporting infrastructure. Taking this kind of proactive approach ensures we have a complete hunting ground to root out assailants and enables a rapid response—allowing us to secure our clients' environments thoroughly and quickly.

Where Cloud and SaaS are concerned, this should be the new standard.

Remember that concealment is the mode of operation for these espionage attacks. The pressing issue, therefore, is not only whether you are susceptible to this type of attack, but, more importantly, whether an attacker has already breached your environment and is currently operating within it. At Mitiga, we provide our clients with the reassurance that their environment is secure, even when hidden dangers are present.

Stay Informed. Stay vigilant.

If you want to learn more about how your enterprise could be strengthening your preparedness to be ready for these types of exploits, contact us.

LAST UPDATED:

November 7, 2024

Don't miss these stories:

Cyber Trends for 2024: What Security Leaders Should be Executing Next

As we hurtle into this new year, it’s already clear that there is an evolving set of cyber risks that organizations will need to contend with successfully to manage threats and grow their organizational resilience in 2024. Below, I’ll outline three of the biggest ones, sharing recommendations and execution checklists that can help enterprises enhance their threat readiness and elevate security postures as the threat landscape continues to evolve.

How to Protect Your Business From the Most Dangerous Cyberthreats

Ransomware attacks are on the rise, and it now more important then ever to be prepared. Be prepared by having an up-to-date incident response plan. Learn more.

Stop Ransomware Attackers From Getting Paid to Play Double-Extortionware Games

In the past, many companies relied on backups to get back to business quickly if they were attacked. Reliable, secure backups separated from the primary environment made it much more difficult for an attacker to access and encrypt them. That long-standing process no longer deters double-extortionware actors — instead, today’s attackers not only encrypt the data but also exfiltrate it.

SEC Cyber Disclosure Rule FAQ: What Leaders are Asking Us

The U.S. Securities and Exchange Commission (SEC) recently implemented a new rule mandating stringent cybersecurity incident reporting and disclosure requirements for public companies.

Log4Shell - identify vulnerable external-facing workloads in AWS

Cloud-based systems should be thoroughly searched for the new Log4j vulnerability (CVE-2021-44228). But this is a daunting task, since you need to search each and every compute instance, from the biggest EC2 instance to the smallest Lambda function. This is where Mitiga can help.

For Incident Response, Give Peacetime Value a Chance

As an IR vendor, it is important to keep your customers up to date and prepared between breach attempts. Learn how to increase your peacetime value now.