Storm-0558Threat actor
Storm-0558 is a China-based threat actor with espionage objectives. While there are some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), Microsoft maintain high confidence that Storm-0558 operates as its own distinct groupFrom MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
Suspected originChinaMISP Galaxy
Targets sectorsGovernmentMISP Galaxy
Targets countriesUnited States, GermanyMISP Galaxy
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Shadow IT: The Initial Access You Didn’t Log“In 2023, Microsoft disclosed activity linked to Storm-0558 involving forged authentication tokens and unauthorized access to cloud email systems.”
-
Identity: The Third Phase of Security Operations“In July 2023, Microsoft published limited information on a group tracked as Storm-0558.”
Thanks — we review every report.