Thursday, March 28, 2024

Microsoft Now Takes Control of 99 Websites that Used for Hacking Operations by APT 35 Hackers

A result of cyberwar between Microsoft and the APT 35 hackers group, now Microsoft authorized to seize 99 illegal domains that operated by the APT 35 For various illegal hacking operations.

Microsoft won the court case that filled in the U.S. District Court for Washington D.C against the APT group 35 also known as Phosphorus and granted an order by the court to take down all the 99 websites.

APT 35 or Charming Kitten is a well-known Iranian cybercrime group that performing the various illegal hacking operation using various domains which was continuously tracking since 2013 by Microsoft Threat Intelligence Center (MSTIC).

Since the court has given the complete permission on last week, Microsoft has taken the complete control of 99 websites the group uses to conduct its hacking operations.

All these domains were misused under the names of well-known brands, like Microsoft and other related domain such as outlook-verify.net, yahoo-verify.net, verification-live.com, and myaccount-services.net.

APT 35 mainly used these illegal domains for various sophisticated cyber crimes, and it’s specifically designed to gain access to the computer systems of businesses and government agencies and steal sensitive information.

Now All The 99 Domains are Under Microsoft Control

Microsoft now takes complete control of all the 99 domains that was used for various malicious hacking operations and all these domains traffic has been redirected from infected devices to Microsoft Digital Crime Unit’s sinkhole.

A sinkhole is basically a way of redirecting malicious Internet traffic so that it can be captured and analyzed by security analysts.

In this case, all the intelligence collected from this sinkhole will be added to MSTIC’s existing knowledge of Phosphorus and shared with Microsoft security products and services to protect customers in the future.

According to Microsoft, “Phosphorus also uses these domains and a technique whereby it sends people an email that makes it seem as if there’s a security risk to their accounts, prompting them to enter their credentials into a web form that enables the group to capture their passwords and gain access to their systems.”

Throughout the course of tracking Phosphorus, we’ve worked closely with a number of other technology companies, including Yahoo, to share threat information and jointly stop attacks. We are grateful for their partnership, Microsoft said.

Learn: A complete Certified Cyber Threat Intelligence Analyst
Online course

Also Read:

Microsoft Released Security Updates that Fixes 64 Vulnerabilities Including 2 Active Zero-day Flaw

Microsoft Advises Users to Stop Using Internet Explorer Browser

For the First Time, Cryptojacking Apps is Found on Microsoft Store

Website

Latest articles

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles