Analysis of Storm-0558 techniques for unauthorized email access | Microsoft Security Blog (www.microsoft.com)
from Penguincoder@beehaw.org to cybersecurity@infosec.pub on 16 Jul 2023 01:40
https://beehaw.org/post/2147415

Storm-0558 used forged authentication tokens to access user email from approximately 25 organizations, including government agencies and related consumer accounts in the public cloud

Not very low level, but good details on some of the threat actor activities.