outbrain
Close  

Microsoft seizes web domains used by North Korean hackers

/ 06:59 AM December 31, 2019

 

(FILES) In this file photo taken on November 6, 2019 Attendees walk past the logo of US multinational technology company Microsoft during the Web Summit in Lisbon. – Microsoft said on December 30, 2019 it obtained a court order allowing it to seize web domains used by North Korean hacking groups to launch cyberattacks on human rights activists, researchers and others. The US technology giant said a federal court allowed it to take control of 50 domains operated by a group dubbed Thallium, which tricked online users by fraudulently using Microsoft brands and trademarks. (Photo by PATRICIA DE MELO MOREIRA / AFP)

WASHINGTON — Microsoft said Monday it obtained a court order allowing it to seize web domains used by North Korean hacking groups to launch cyberattacks on human rights activists, researchers and others.

ADVERTISEMENT

The U.S. technology giant said a federal court allowed it to take control of 50 domains operated by a group dubbed Thallium, which tricked online users by fraudulently using Microsoft brands and trademarks.

“This network was used to target victims and then compromise their online accounts, infect their computers, compromise the security of their networks and steal sensitive information,” said Tom Burt, Microsoft’s vice president for customer security and trust.

FEATURED STORIES

“Based on victim information, the targets included government employees, think tanks, university staff members, members of organizations focused on world peace and human rights, and individuals that work on nuclear proliferation issues. Most targets were based in the US, as well as Japan and South Korea.”

Microsoft, which had been investigating the group through its Digital Crimes Unit and Threat Intelligence Center, said the hacking group sent spoofed emails that appeared to come from Microsoft which tricked users into revealing their login credentials, a technique known as spear phishing.

“By gathering information about the targeted individuals from social media, public personnel directories from organizations the individual is involved with and other public sources, Thallium is able to craft a personalized spear-phishing email in a way that gives the email credibility to the target,” Burt said.

After getting the victim’s credentials, the hackers can access emails, contact lists, calendar appointments and other data and often forwards any new emails to the attackers.

The hackers also used malicious software that can access other data on a victim’s computer.

An order from a U.S. federal court in Virginia allowed Microsoft to take control of the domains, meaning “the sites can no longer be used to execute attacks,” Burt said.

Microsoft said this was the fourth nation-state group it has acted against and follows similar moves against operations from China, Russia and Iran, dubbed Barium, Strontium, and Phosphorus, respectively.

ADVERTISEMENT

Edited by MUF
TOPICS: Crime, cyberattacks, hacking, IT, Microsoft, North Korea, u.s.
Read Next
EDITORS' PICK
MOST READ
Don't miss out on the latest news and information.
View comments

Subscribe to INQUIRER PLUS to get access to The Philippine Daily Inquirer & other 70+ titles, share up to 5 gadgets, listen to the news, download as early as 4am & share articles on social media. Call 896 6000.

For feedback, complaints, or inquiries, contact us.


© Copyright 1997-2020 INQUIRER.net | All Rights Reserved

We use cookies to ensure you get the best experience on our website. By continuing, you are agreeing to our use of cookies. To find out more, please click this link.