Did Storm 0558 Access an On-Premises Hardware Security Module?
Set-up: On June 14th @Serghei for Bleeping Computer tweeted that “Microsoft says it still doesn’t know how Storm-0558 Chinese hackers stole an inactive MSA consumer signing key used to breach the Exchange Online and Azure AD accounts of two dozen organizations, including U.S. government agencies.” Bleeping Computer seemed to rely on a June 14th update…