{"id":53576,"date":"2023-09-07T22:12:00","date_gmt":"2023-09-07T22:12:00","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/microsoft-ids-security-gaps-that-let-threat-actor-steal-signing-key"},"modified":"2023-09-07T22:12:00","modified_gmt":"2023-09-07T22:12:00","slug":"microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/","title":{"rendered":"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key"},"content":{"rendered":"
<\/div>\n

Several security missteps on Microsoft’s part allowed a China-based threat actor to forge authentication tokens and access user email from some 25 Microsoft enterprise customers earlier this year, the company’s investigation has shown.<\/p>\n

The attacks<\/a> by a Chinese cyber espionage group that Microsoft is tracking as Storm-0558 were noteworthy because they involved the threat actor using a Microsoft account (MSA) consumer signing key to forge Azure AD tokens for accessing enterprise email accounts. MSA consumer keys are typically used to cryptographically sign into a Microsoft consumer application or service such as Outlook.com, OneDrive, and Xbox Live.<\/p>\n

Cyber Espionage Campaign<\/h2>\n

Storm-0558 is believed to be a China-nexus cyber espionage group that has been active since at least 2021. Its targets have included US and European diplomatic entities, legislative governing bodies, media companies, Internet service providers, and telecommunications equipment manufacturers. In many of its attacks, the threat actor has used credential harvesting, phishing campaigns, and OAuth token attacks to gain access to target email accounts.<\/p>\n

Microsoft discovered the group’s latest campaign in May when a customer reported anomalous activity<\/a> involving their Exchange Server account. The company’s initial investigation showed the threat group had accessed the customer’s Exchange online data via Outlook Web Access. Early on, Microsoft assumed the adversary had somehow obtained an Azure AD enterprise signing key and was using it to forge tokens for authenticating to Exchange Server. But further investigation showed that Storn-0558 in fact was using an acquired MSA consumer signing key to do the token forging \u2014 something the company attributed at the time to a “validation error.”<\/p>\n

In a report this week<\/a>, Microsoft released the findings of its subsequent two-and-a-half-month long technical investigation into the incident, which describes exactly how the attack chain played out and the now-corrected mistakes that enabled the whole thing.<\/p>\n

A Series of Unfortunate Errors<\/h2>\n

According to the company, the problem started with a now-resolved race condition that resulted in the signing key being present in a crash dump.<\/p>\n

Typically, the signing key should never have escaped the company’s otherwise secure production environment, which is isolated and incorporates several security controls. These include background checks for employees, dedicated production accounts, secure workstations, and hardware token-based two-factor authentication. “Controls in this environment also prevent the use of email, conferencing, web research, and other collaboration tools, which can lead to common account compromise vectors,” Microsoft said in its report this week.<\/p>\n

Those controls, however, were not enough when a consumer key-signing system in the production environment crashed in April 2021 and a signing key was included in either the crash dump or a snapshot of the crashed system. Normally, the key should have been redacted from the dump, but that didn’t happen because of the race condition. Worse, none of Microsoft’s controls detected the sensitive information in the crash dump, which eventually ended up with the debugging team on Microsoft’s Internet-connected corporate network. Here again, the company’s controls for spotting credential data in the debugging environment failed to spot the leaked consumer key.<\/p>\n

As Microsoft explained it, while the company’s corporate environment is secure, it also allows for the use of email, conferencing, and other collaboration tools that make users somewhat more vulnerable to spear-phishing attacks, token-stealing malware, and other attack vectors.<\/p>\n

At some point, Storm-0558 actors managed to successfully compromise a Microsoft engineer’s corporate account and used the account’s access to the debugging environment to steal data \u2014 including the runaway key \u2014 from there.<\/p>\n

The Consumer Key Mystery Explained<\/h2>\n

As to how a consumer key allowed the attacker to forge Azure AD tokens, Microsoft points to a common key metadata publishing endpoint it established in September 2018. “As part of this converged offering, Microsoft updated documentation to clarify the requirements for key scope validation \u2014 which key to use for enterprise accounts, and which to use for consumer accounts,” Microsoft said.<\/p>\n

But here again \u2014 and for a variety of reasons having to do with ambiguous documentation and library updates, APIs, and other factors \u2014 the key scope validation did not work as intended. The net result was the “email system would accept a request for enterprise email using a security token signed with the consumer key,” Microsoft said.<\/p>\n

To address the problem, Microsoft has eliminated the race condition that allowed the key data to be included in crash dumps. The company has also upped its mechanisms for detecting signing keys in places where they should not be, including in the debugging environment. In addition, Microsoft said it has improved its automated scope validation mechanism to eliminate the potential for a similar mishap.<\/p>\n

Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

China’s Storm-0558 accessed user emails at some 25 enterprise organizations earlier this year using forged tokens.Read More HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-53576","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"\nMicrosoft ID Security Gaps That Let Threat Actor Steal Signing Key 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-09-07T22:12:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt9e7ab655fdfe6acc\/64fa3bcdfc70f5f529d01bea\/azure_Primakov_shutterstock.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key\",\"datePublished\":\"2023-09-07T22:12:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/\"},\"wordCount\":779,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt9e7ab655fdfe6acc\\\/64fa3bcdfc70f5f529d01bea\\\/azure_Primakov_shutterstock.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/\",\"name\":\"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt9e7ab655fdfe6acc\\\/64fa3bcdfc70f5f529d01bea\\\/azure_Primakov_shutterstock.jpg\",\"datePublished\":\"2023-09-07T22:12:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt9e7ab655fdfe6acc\\\/64fa3bcdfc70f5f529d01bea\\\/azure_Primakov_shutterstock.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt9e7ab655fdfe6acc\\\/64fa3bcdfc70f5f529d01bea\\\/azure_Primakov_shutterstock.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/","og_locale":"en_US","og_type":"article","og_title":"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-09-07T22:12:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt9e7ab655fdfe6acc\/64fa3bcdfc70f5f529d01bea\/azure_Primakov_shutterstock.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key","datePublished":"2023-09-07T22:12:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/"},"wordCount":779,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt9e7ab655fdfe6acc\/64fa3bcdfc70f5f529d01bea\/azure_Primakov_shutterstock.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/","url":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/","name":"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt9e7ab655fdfe6acc\/64fa3bcdfc70f5f529d01bea\/azure_Primakov_shutterstock.jpg","datePublished":"2023-09-07T22:12:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt9e7ab655fdfe6acc\/64fa3bcdfc70f5f529d01bea\/azure_Primakov_shutterstock.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt9e7ab655fdfe6acc\/64fa3bcdfc70f5f529d01bea\/azure_Primakov_shutterstock.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/microsoft-id-security-gaps-that-let-threat-actor-steal-signing-key\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Microsoft ID Security Gaps That Let Threat Actor Steal Signing Key"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/53576","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=53576"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/53576\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=53576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=53576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=53576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}