Page 224 - Cyber Defense eMagazine Annual RSA Edition for 2024

Inside the Storm-0558 Attack on Microsoft: Can

Improved Key Rotation Prevent the Next Big Breach?

By Amit Zimerman, Co-Founder and CPO at Oasis Security

The Storm-0558 attack represents a sophisticated and targeted cyber intrusion that severely
compromised Microsoft Exchange Online mailboxes. This breach led to the exposure of sensitive emails
belonging to top U.S. officials, including Commerce Secretary Gina Raimondo, showcasing its extensive
impact on national security. As cybersecurity experts analyze this unprecedented breach, the significant
role played by critical failures in managing non-human identities (NHIs) becomes evident. NHIs are the
digital constructs pivotal for machine-to-machine access and authentication in today's evolving, machine-
centric enterprise systems, especially as organizations transition towards machine-centric architectures.

Attributed to China's Ministry of State Security by U.S. intelligence, the attackers exploited specific,
previously unidentified vulnerabilities within Microsoft's cloud infrastructure. This breach, occurring in the
spring of 2023, affected 22 organizations and over 500 individuals globally. The attackers used
sophisticated techniques like exploiting unrotated authentication tokens linked to a Microsoft key
established in 2016, highlighting the importance of implementing strong non-human identity management
and secret rotation practices.

224