Storm-0558

No sourced public emblem in this profile.

reference profile · reported nexus: CN (not nationality)

Storm-0558 is a China-based threat actor with espionage objectives. While there are some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), Microsoft maintain high confidence that Storm-0558 operates as its own distinct group

Source-reported aliases: . Associations do not prove equivalence.

Target geography

Catalog-listed countries (associations, not attack counts): United States of America · Germany

No bound claim-post feed for this label.

Historical casebook

No dated record curated yet; absence does not establish inactivity.

Planned Kinwilder coverage

Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.

No assigned review window.

References

Pinned source catalog

https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/

https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr

https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/

https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Analysen-und-Prognosen/Threat-Intelligence/Aktive_APT-Gruppen/aktive-apt-gruppen_node.html

https://blogs.microsoft.com/on-the-issues/2023/07/11/mitigation-china-based-threat-actor/

https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/

https://www.youtube.com/watch?v=khywfhJv4H8

https://www.cisa.gov/sites/default/files/2024-04/CSRB_Review_of_the_Summer_2023_MEO_Intrusion_Final_508c.pdf

Submission and profile-update guide · Publisher API

Editorial standard · root@kinwilder.com · RSS · Outpost