By 
An unnamed Federal Civilian Executive Branch (FCEB) agency in the U.S. identified suspicious activity in their Microsoft 365 (M365) cloud environment in mid-June 2023, leading to Microsoft's discovery of a new China-linked espionage campaign targeting two dozen organizations.
The details come from a joint cybersecurity advisory released by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) on July 12, 2023.
While the name of the government agency was not revealed, CNN and the Washington Post reported it was the U.S. State Department. The Commerce Department as well as the email accounts belonging to a congressional staffer, a U.S. human rights advocate, and U.S. think tanks were also targeted.
Microsoft attributed the campaign to an emerging "China-based threat actor" tracked as Storm-0558, which primarily targets government agencies in Western Europe and focuses on espionage and data theft.
China, has rejected accusations it was behind the hacking incident, calling the U.S. "the world's biggest hacking empire and global cyber thief" and that it's "high time that the U.S. explained its cyber-attack activities and stopped spreading disinformation to deflect public attention."
The attack chain entailed the cyber spies leveraging forged authentication tokens to gain access to customer email accounts using Outlook Web Access in Exchange Online (OWA) and Outlook.com. The tokens were forged using an acquired Microsoft account (MSA) consumer signing key.
The FCEB agency was able to identify the breach by leveraging enhanced logging in Microsoft Purview Audit, specifically using the MailItemsAccessed mailbox-auditing action.
The agency is further recommending that organizations enable Purview Audit (Premium) logging, turn on Microsoft 365 Unified Audit Logging (UAL), and ensure logs are searchable by operators to allow hunting for this kind of activity and differentiate it from expected behavior within the environment.
Image Credits : The Hindu
