A currently unnamed United States Federal Civilian Executive Branch (FCEB) agency has recently detected anomalous activity in their Microsoft 365 audit logs in mid-June of 2023 and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a joint cybersecurity advisory (AA23-193A) on July 12, 2023, sharing details of the incident. The details were also shared with Microsoft and deemed to be advanced persistent threat (APT) activity where the actors “accessed and exfiltrated unclassified Exchange Online Outlook data” from a small number of accounts within the agency. CISA detailed that the actors accessed the data by utilizing a Microsoft account consumer key to “forge tokens to impersonate consumer and enterprise users.” Prior to CISA’s advisory, Microsoft published a blog post that detailed an observed attack by the new China-based threat actor Storm-0558 exploiting a vulnerability in Microsoft’s cloud email service to “spy on two-dozen organizations, including some government agencies,” and target customer emails. Storm-0558 is known to primarily target government agencies in Western Europe and focuses on credential access, data theft, and espionage. It should be noted that Microsoft began investigating the detailed incidents after one (1) organization reported the bug and a White House National Security Council spokesperson shared that the flaw was first detected by the U.S. government. Microsoft did not disclose the organizations impacted by this activity in their report, but the details of the attack in CISA’s advisory are identical to those in Microsoft’s report. As more details of the attack and victims are released, CTIX analysts will continue to monitor this incident and release updates as necessary.