Microsoft Now Takes Control of 99 Websites that Used for Hacking Operations by APT 35 Hackers

A result of cyberwar between Microsoft and the APT 35 hackers group, now Microsoft authorized to seize 99 illegal domains that operated by the APT 35 For various illegal hacking operations.

Microsoft won the court case that filled in the U.S. District Court for Washington D.C against the APT group 35 also known as Phosphorus and granted an order by the court to take down all the 99 websites.

APT 35 or Charming Kitten is a well-known Iranian cybercrime group that performing the various illegal hacking operation using various domains which was continuously tracking since 2013 by Microsoft Threat Intelligence Center (MSTIC).

Since the court has given the complete permission on last week, Microsoft has taken the complete control of 99 websites the group uses to conduct its hacking operations.

All these domains were misused under the names of well-known brands, like Microsoft and other related domain such as outlook-verify.net, yahoo-verify.net, verification-live.com, and myaccount-services.net.

APT 35 mainly used these illegal domains for various sophisticated cyber crimes, and it’s specifically designed to gain access to the computer systems of businesses and government agencies and steal sensitive information.

Now All The 99 Domains are Under Microsoft Control

Microsoft now takes complete control of all the 99 domains that was used for various malicious hacking operations and all these domains traffic has been redirected from infected devices to Microsoft Digital Crime Unit’s sinkhole.

A sinkhole is basically a way of redirecting malicious Internet traffic so that it can be captured and analyzed by security analysts.

In this case, all the intelligence collected from this sinkhole will be added to MSTIC’s existing knowledge of Phosphorus and shared with Microsoft security products and services to protect customers in the future.

According to Microsoft, “Phosphorus also uses these domains and a technique whereby it sends people an email that makes it seem as if there’s a security risk to their accounts, prompting them to enter their credentials into a web form that enables the group to capture their passwords and gain access to their systems.”

Throughout the course of tracking Phosphorus, we’ve worked closely with a number of other technology companies, including Yahoo, to share threat information and jointly stop attacks. We are grateful for their partnership, Microsoft said.

Learn: A complete Certified Cyber Threat Intelligence Analyst
Online course

Also Read:

Microsoft Released Security Updates that Fixes 64 Vulnerabilities Including 2 Active Zero-day Flaw

Microsoft Advises Users to Stop Using Internet Explorer Browser

For the First Time, Cryptojacking Apps is Found on Microsoft Store