
Attribution is based on Microsoft Threat Intelligence assessment that Storm-0558 is a China-based threat actor with activities and methods consistent with espionage objectives.Īt first Microsoft assumed that the spies were using legitimate Azure Active Directory (Azure AD) tokens stolen by malware. Microsoft analysis attributed the activity to a group called Storm-0558 based on established prior tactics, techniques, and procedures (TTPs). Investigation learned that the customer’s Exchange Online data was accessed using Outlook Web Access (OWA). The investigation started on Jun 16, 2023, when Microsoft was notified by a customer about an anomalous Exchange Online data access. The attacks were targeted and lasted for about a month before they were first discovered. Post questions, follow discussions and share your knowledge in the Community.Microsoft is getting criticized for the way in which it handled a serious security incident that allowed a suspected Chinese espionage group to access user email from approximately 25 organizations, including government agencies and related consumer accounts in the public cloud. To get help and troubleshoot other Microsoft products and services, enter your problem here. If you can't sign in, click here.įor other help with your Microsoft account and subscriptions, visit Account & Billing Help.

To contact us in, you'll need to sign in. If the self-help doesn't solve your problem, scroll down to Still need help? and select Yes. To get support in, click here or select Help on the menu bar and enter your query. You can also get support from other users in our Community forum, or get help by selecting Contact Support below: Which browsers work with Office for the web and Office Add-ins Still need help?

If you're still having problems with signing in, read When you can't sign in to your Microsoft account. On the Enter password page, clear Keep me signed in. Go to the sign-in page and select Sign in.Įnter your email address or phone number and select Next.

In, select your account picture at the top of the screen. If automatically signs you in, turn off automatic sign in.
