Microsoft, DOJ Dismantle Domains Used by Russian FSB-Linked Hacking Group

Microsoft and the U.S. Department of Justice (DOJ) have successfully dismantled a network of domains a Russian hacking group linked to the Federal Security Service (FSB) uses.

This collaborative effort is critical in countering cyber threats targeting democratic institutions worldwide.

Seizing Domains to Disrupt Cyberattacks

In coordination with the DOJ, Microsoft’s Digital Crimes Unit (DCU) has seized over 100 domains associated with the hacking group known as Star Blizzard.

This operation was authorized by a civil action unsealed by the United States District Court for the District of Columbia.

Between January 2023 and August 2024, Star Blizzard targeted more than 30 civil society organizations, including journalists, think tanks, and NGOs. These attacks aimed to exfiltrate sensitive information and interfere with democratic processes. 

Analyse Any Suspicious Links Using ANY.RUN’s New Safe Browsing Tool: Try for Free

The joint action by Microsoft and the DOJ involved seizing 66 domains identified by Microsoft and an additional 41 domains seized by the DOJ.

The disruption of this infrastructure is expected to significantly hinder Star Blizzard’s operations, which have been relentlessly targeting high-value entities supporting democratic governance.

Persistent Threat from Star Blizzard

Star Blizzard, also known as COLDRIVER and Callisto Group, has been active since at least 2017. The group has improved its detection evasion capabilities, focusing on email credential theft.

Their recent targets include NGOs and think tanks that support government employees and military officials, particularly those aiding Ukraine and NATO countries.

In 2023, the British government attributed Star Blizzard’s activities to the Russian FSB, highlighting their attempts to interfere in UK politics. The group meticulously studies its targets, posing as trusted contacts to execute spear-phishing campaigns.

Since January 2023, Microsoft has identified 82 customers targeted by Star Blizzard, averaging one attack per week. 

Collaboration and Ongoing Vigilance

Microsoft’s collaboration with the DOJ exemplifies the impact of united efforts against sophisticated cyber threats.

The DCU will continue to innovate in disrupting cybercriminal infrastructure while collaborating with private sector partners, civil society, government agencies, and law enforcement. 

This operation underscores the need for international norms governing responsible state behavior online.

Microsoft encourages civil society groups to enhance their cybersecurity measures, use strong multi-factor authentication, and enroll in programs like Microsoft’s AccountGuard to protect against nation-state cyberattacks. 

By taking decisive action against Star Blizzard, Microsoft and its partners reinforce international norms and demonstrate a commitment to protecting civil society and upholding the rule of law in cyberspace.

This effort disrupts current threats and sets a precedent for future collaborations to safeguard democratic institutions from cyber interference.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Registration