"Microsoft Breach Exposed 60,000 State Department Emails"

According to Microsoft, a sophisticated Chinese cyber-espionage campaign targeting Microsoft Outlook accounts gave Beijing access to tens of thousands of private US government emails.  The Storm-0558 group was able to steal 60,000 emails from 10 State Department accounts, nine of which were used by individuals working on East Asia and Pacific diplomacy.  According to a State Department briefing,  the hackers were also able to get hold of a list containing all of the department’s email accounts.  In July, Microsoft revealed a Chinese cyber-espionage campaign had compromised at least 25 organizations, including the US government.  Earlier this month, it emerged that the threat actors had obtained the signing key after first breaching the account of a Microsoft engineer.  It was also recently revealed that Storm-0558 had exploited a zero-day validation issue in the GetAccessTokenForResourceAPI, enabling it to forge signed access tokens and impersonate accounts within the State Department and other targeted organizations.

Infosecurity reports: "Microsoft Breach Exposed 60,000 State Department Emails"