The software King of the World said that the hackers used the key to forge authentication tokens to access email accounts on Microsoft's cloud servers, including those belonging to Commerce Secretary Gina Raimondo, Representative Don Bacon and State Department officials earlier this year.

The U.S. Cybersecurity and Infrastructure Security Agency and Microsoft disclosed the breach in June, but it was still unclear at the time exactly how hackers were able to steal the key that allowed them to access the email accounts. Microsoft said the key had been improperly stored within a "crash dump," which is data stored after a computer or application unexpectedly crashes.

Vole's blog post says they corrected two conditions which allowed this to occur. First, "a race condition allowed the key to be present in the crash dump," and second, "the key material's presence in the crash dump was not detected by our systems."

Microsoft found that this crash dump, believed at the time not to contain key material, was subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network. This is consistent with Vole's standard debugging processes. Microsoft's credential scanning methods did not detect its presence (this issue has been corrected), the company said.

After April 2021, when the key was leaked to the corporate environment in the crash dump, the Storm-0558 actor successfully compromised a Microsoft engineer's corporate account. This account had access to the debugging environment containing the crash dump which incorrectly contained the key. Due to log retention policies, Vole didnt have logs with specific evidence of this exfiltration by this hacker, but this was the most probable mechanism by which the actor acquired the key.