Microsoft's storm-proof defense wins

Emre Çitak
Jul 13, 2023
Updated • Jul 13, 2023

Microsoft has successfully countered a cyber-attack conducted by Storm-0558, a threat actor believed to be linked to China.

This attack specifically targeted customer emails, putting user accounts and sensitive information at risk.

However, through its relentless efforts and robust security measures, Microsoft has managed to neutralize the threat, ensuring the safety of its users and preventing unauthorized access to their email accounts.

Microsoft Storm-0558
Microsoft recently announced that it successfully mitigated a cyber-attack conducted by Storm-0558 - Image: Microsoft

Who is Storm-0558?

Storm-0558 is a notorious threat actor that primarily focuses on government agencies located in Western Europe. These malicious individuals engage in cyber activities such as cyber espionage, data theft, and credential access attacks.

The attack was brought to Microsoft's attention on June 16, 2023, when a customer reported suspicious activity. Following a thorough investigation, it was revealed that Storm-0558 had gained unauthorized access to email accounts associated with approximately 25 organizations.

These organizations included government agencies and individual consumer accounts associated with these entities.

Microsoft Storm-0558
Storm-0558 engages in various cyber activities, including cyberespionage, data theft, and credential access attacks

Microsoft's ongoing battle with Storm-0558

Microsoft has been engaged in an ongoing battle with Storm-0558, constantly working to counter their cyber attacks and protect its users' data. When Storm-0558 initiated the attack on May 15, 2023, they employed a technique involving forged authentication tokens.

By utilizing a Microsoft account (MSA) consumer signing key they had obtained, Storm-0558 was able to forge these tokens, bypassing security measures and gaining access to Outlook Web Access in Exchange Online (OWA) and This enabled them to compromise a significant number of email accounts, potentially compromising sensitive information.

Microsoft Storm-0558
Microsoft's telemetry systems detected Storm-0558's activities and effectively blocked their access to customer email accounts

However, Microsoft's robust security systems detected Storm-0558's activities and promptly blocked their access to customer email accounts. Through advanced telemetry and security measures, Microsoft successfully prevented Storm-0558 from further exploiting the forged authentication tokens.

In a recent statement, Microsoft assured its users that no further action was required from their end.

Need to stay vigilant

Microsoft has taken a proactive approach to support the affected organizations. They have directly contacted the targeted entities, providing them with important information to aid in their investigation and response efforts.

This demonstrates Microsoft's dedication to assisting its customers and ensuring their continued security in the face of cyber threats.

You may check Microsoft's detailed investigation process via the link here.


Tutorials & Tips

Previous Post: «
Next Post: «


  1. Some Dude said on March 19, 2023 at 11:42 am

    Are these articles AI generated?

    Now the duplicates are more obvious.

    1. boris said on March 19, 2023 at 11:48 pm

      This is below AI generated crap. It is copy of Microsoft Help website article without any relevant supporting text. Anyway you can find this information on many pages.

  2. Paul(us) said on March 20, 2023 at 1:32 am

    Yes, but why post the exact same article under a different title twice on the same day (19 march 2023), by two different writers?
    1.) Excel Keyboard Shortcuts by Trevor Monteiro.
    2.) 70+ Excel Keyboard Shortcuts for Windows by Priyanka Monteiro

    Why oh why?

    1. Clairvaux said on September 6, 2023 at 11:30 am

      Yeah. Tell me more about “Priyanka Monteiro”. I’m dying to know. Indian-Portuguese bot ?

  3. John G. said on August 18, 2023 at 4:36 pm

    Probably they will announce that the taskbar will be placed at top, right or left, at your will.

    Special event by they is a special crap for us.

  4. yanta said on August 18, 2023 at 11:59 pm

    If it’s Microsoft, don’t buy it.
    Better brands at better prices elsewhere.

  5. John G. said on August 20, 2023 at 4:22 am

    All new articles have zero count comments. :S

  6. Anonymous said on September 5, 2023 at 7:48 am

    WTF? So, If I add one photo to 5 albums, will it count 5x on my storage?
    It does not make any sense… on google photos, we can add photo to multiple albums, and it does not generate any additional space usage

    I have O365 until end of this year, mostly for onedrive and probably will jump into google one

  7. St Albans Digital Printing Inc said on September 5, 2023 at 11:53 am

    Photo storage must be kept free because customers chose gadgets just for photos and photos only.

  8. Anonymous said on September 5, 2023 at 12:47 pm

    What a nonsense. Does it mean that albums are de facto folders with copies of our pictures?

    1. GG said on September 6, 2023 at 8:24 am

      Sounds exactly like the poor coding Microsoft is known for in non-critical areas i.e. non Windows Core/Office Core.

      I imagine a manager gave an employee the task to create the album feature with hardly any time so they just copied the folder feature with some cosmetic changes.

      And now that they discovered what poor management results in do they go back and do the album feature properly?

      Nope, just charge the customer twice.

      Sounds like a go-getter that needs to be promoted for increasing sales and managing underlings “efficiently”, said the next layer of middle management.

  9. d3x said on September 5, 2023 at 7:33 pm

    When will those comments get fixed? Was every editor here replaced by AI and no one even works on this site?

  10. Scroogled said on September 5, 2023 at 10:47 pm

    Instead of a software company, Microsoft is now a fraud company.

  11. ard said on September 7, 2023 at 4:59 pm

    For me this is proof that Microsoft has a back-door option into all accounts in their cloud.
    quote “…… as the MSA key allowed the hacker group access to virtually any cloud account at Microsoft…..”

    so this MSA key which is available to MS officers can give access to all accounts in MS cloud.This is the backdoor that MS has into the cloud accounts. Lucky I never got any relevant files of mine in their (MS) cloud.

  12. Andy Prough said on September 7, 2023 at 6:52 pm

    >”Now You: what is your theory?”

    That someone handed an employee a briefcase full of cash and the employee allowed them access to all their accounts and systems.

    Anything that requires 5-10 different coincidences to happen is highly unlikely. Occam’s razor.

  13. TelV said on September 8, 2023 at 12:04 pm

    Good reason to never login to your precious machine with a Microsoft a/c a.k.a. as the cloud.

  14. Anonymous said on September 18, 2023 at 1:23 pm

    The GAFAM are always very careless about our software automatically sending to them telemetry and crash dumps in our backs. It’s a reminder not to send them anything when it’s possible to opt out, and not to opt in, considering what they may contain. And there is irony in this carelessness biting them back, even if in that case they show that they are much more cautious when it’s their own data that is at stake.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.