China-Based Hackers Penetrate US Government Emails via Microsoft Cloud, Company Reports

In a series of blog posts, Microsoft revealed a calculated intrusion carried out by a Chinese hacking consortium known as "Storm-0558". The sophisticated cyber-espionage campaign involved unauthorized access to several email accounts affiliated with approximately 25 entities, including at least two US government departments.

As detailed in a report by The Washington Post, Commerce Secretary Gina Raimondo emerges as the only confirmed Cabinet-level official whose account was violated during this strategic cyber-offensive. While officials affirm that these breaches have been contained, an investigation led by the Federal Bureau of Investigation (FBI) is currently underway.

In comparing this cyber infiltration to the significant digital breaches of late 2020, attributed to Russian cyber spies and known as the SolarWinds compromise, a high-ranking US government official explained the notable difference. "This intrusion should not be compared to SolarWinds," the official cautioned, describing the recent incursion as "much narrower."

Regarding Microsoft's attribution of the cyber-attack to China, the US official declined to comment.

In its statement, Microsoft detailed the modus operandi of the hackers, who fabricated digital authentication tokens to infiltrate webmail accounts operating via Microsoft's Outlook service. According to the tech giant, the covert activities started as early as May.

In its role as the first line of defense against such cyber threats, Microsoft took swift action. "As with any observed nation-state actor activity, Microsoft has contacted all targeted or compromised organisations directly via their tenant admins and provided them with important information to help them investigate and respond," the company declared.

Although Microsoft refrained from naming the compromised organizations or governments, it confirmed that the 'Storm-0558' group has predominantly targeted institutions in Western Europe.

Responding to the accusations, China's embassy in London decried the allegations as "disinformation," branding the US government as "the world's biggest hacking empire and global cyber thief." Irrespective of the existing evidence or context, China routinely dismisses involvement in any hacking operations.

Adam Hodge, spokesperson for the White House National Security Council, clarified that the Microsoft cloud intrusion had "affected unclassified systems," though he did not provide further details. "Officials immediately contacted Microsoft to find the source and vulnerability in their cloud service," Hodge added.

Following the detection of "anomalous activity," the State Department and the Commerce Department have both ensured immediate measures to secure their respective systems. These actions were undertaken in response to Microsoft's notification of a potential compromise.

Leading private sector cybersecurity specialists indicate that this recent hacking activity serves as a testament to the enhanced cyber capabilities of Chinese groups. John Hultquist, the chief analyst for U.S. cybersecurity firm Mandiant, observed, "Chinese cyber espionage has come a long way from the smash-and-grab tactics many of us are familiar with."