Below is a more detailed report about the IOCs, but indeed, they don’t seem to want to say anything about the original source of the key leak.

https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/

Yes, that part is still undisclosed by Microsoft. It is mentioned in the article as well:

We will continue to closely monitor this incident and provide updates; this is still an ongoing investigation and there are many unanswered questions (how did the threat actor acquire the key? When exactly did it happen? Were other keys compromised as well?).

deleted by creator