Antique Typhoon

Summary

China-based espionage actor that Microsoft tracked as Storm-0558 and now names Antique Typhoon. Microsoft assesses with moderate confidence that it is China-based with espionage objectives; the US Cyber Safety Review Board (CSRB, March 2024) describes it as assessed to be affiliated with the People's Republic of China and active since approximately 2000. Historically it has targeted US and European diplomatic, economic and legislative bodies, individuals connected to Taiwan and Uyghur interests, media, think tanks and telecommunications providers, mainly to reach email. From 15 May 2023 it used authentication tokens forged with an acquired Microsoft account (MSA) consumer signing key to read Exchange Online and Outlook.com mail at about 25 organisations (Microsoft) — 22 organisations and more than 500 individuals according to the CSRB, including the US State and Commerce Departments. The US State Department detected the activity in June 2023 and Microsoft had blocked it by early July 2023. Earlier operations used credential phishing (T1566), exploitation of public-facing applications (T1190), China Chopper web shells (T1505.003), the shared Cigril malware launched by DLL search-order hijacking (T1574.001), LSASS and SAM credential theft (T1003.001, T1003.002) and cloud-account mail collection (T1078.004, T1114.002). Microsoft notes minimal overlaps with Violet Typhoon (APT31) but tracks it as a distinct group. The CSRB reports that industry links it to Operation Aurora (2009) and the RSA SecurID intrusion; those links are not adopted here as campaigns. No CVE is involved in the 2023 intrusion: the token-validation flaw was fixed server-side by Microsoft.

Attribution

No service publicly named

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• US Cyber Safety Review Board (DHS/CISA) (Government, 2024-03-20)
  Storm-0558 assessed affiliated with the People's Republic of China
• Microsoft Threat Intelligence (Research, 2023-07-14)
  Moderate confidence: China-based, espionage objectives

Campaigns 1

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 12

Malware and tools 1

Infrastructure patterns

• Dedicated token-replay servers with an actor web panel, stood down 4 July 2023 (Microsoft, 2023)

Reporting and advisories 3

• Microsoft Threat Intelligence
  Analysis of Storm-0558 techniques for unauthorized email access (Jul 2023)
• US Cyber Safety Review Board
  Review of the Summer 2023 Microsoft Exchange Online Intrusion (Mar 2024)
• Microsoft
  How Microsoft names threat actors — Antique Typhoon (Storm-0558)