Talk to an expert

Storm-0558 Unleashes Authentication Token Forgery

By Elliot Anderson | August 1, 2023

Threat Summary:

Storm-0558 is suspected to be a China-based, nation-state threat actor whose TTPs are closely aligned with espionage objectives. This threat actor managed to compromise an inactive MSA signing key which was then used to sign fabricated authentication tokens. Authentication tokens are short-lived credentials that are used to authenticate users to a service. They are typically generated by a server and then passed to the client. The client then presents the token to the server to prove that it is authorized to access such service. Storm-0558 acquired an inactive Microsoft account (MSA) consumer signing key, and then the key was used to sign MSA authentication tokens. The group was then able to use this key to forge authentication tokens for Azure AD enterprise and MSA consumer accounts. These forged tokens allowed Storm-0558 to access OWA and Microsoft has since invalidated all MSA keys that were active prior to the incident.

Lumifi's Analysis:

We've concluded that the specific exploit utilized in this attack isn't reliably detectable due to the attack being performed by compromising an MSA key and signing a fabricated authentication token. However, this threat actor has been observed performing specific activities shortly after exploitation which are reliably detectable.

Lumifi Current Coverage:

Lumifi currently has a number of detections in our content library that would successfully detect this threat actor's exploitation attempts and attack chain. Our foreign login-based rules would detect this attack upon successful authentication of the threat actor. Additionally, we have developed and tailored a number of rules around suspicious O365 and email activity ranging from potential exfiltration detections to logins from a new IP.

By Elliot Anderson
Threat Name
Storm-0558 - Authentication Token Forgery
Share This

Subscribe for Exclusive Updates

Stay informed with the most recent updates, threat briefs, and useful tools & resources. You have the option to unsubscribe at any time.

🚨 New Webinar Alert! 🚨

Q2: SOC Quarterly Threat Briefing

🗓️ Date: July 24th, 2024
🕒 Time: 11 AM (PT)

Secure Your Spot!
Privacy PolicyTerms & ConditionsSitemapSafeHotline
magnifiercrossmenuchevron-down linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram