Microsoft Shuts Down 50 Domains Used by North Korean Hacking Group

Microsoft this week announced it had gained a court order to take control of 50 domains used by a threat group believed to operate out of North Korea.

The US District Court order effectively allowed Microsoft to shut down the domains, which had been used by the so-called Thallium hacking group to target government employees, think tanks, universities, and organizations associated with human rights work and nuclear proliferation — most of them in the US, but also some in Japan and South Korea.

Thallium employs spearphishing attacks, some of which portend to come from Microsoft, in order to fool the victims into giving up their email account credentials. According to Microsoft, Thallium typically sets up a mail-forwarding rule in the hacked email account that allows the attackers to receive the victim's emails, even when the victim changes his or her password. 

The group is known for planting a backdoor known as BabyShark and KimJongRAT on the victim's machine.

The legal action by Microsoft follows previous such takedowns by the company of a Chinese nation-state group called Barium, a Russian nation-state group called Strontium, and an Iran-based group called Phosphorus.

"We think it's critical that governments and the private sector are increasingly transparent about nation-state activity so we can all continue the global dialogue about protecting the internet," Tom Burt, corporate vice president of customer security and trust at Microsoft, wrote in blog post today announcing the legal action. 

Read the full post here. 

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "SIM Swapping Attacks: What They Are & How to Stop Them."