Court hands Microsoft control of websites linked to spying by Chinese hackers

Nickel, aka APT15, Ke3chang and Vixen Panda, was snooping on government agencies and others, the company said.

Microsoft obtained a court order to seize websites from a Chinese government-linked espionage group that was using the sites to attack government agencies, think tanks and human rights organizations in 29 countries, the company said Monday.

The legal move is aimed at a hacking outfit that Microsoft calls Nickel, which is also known as APT15, Ke3chang or Vixen Panda. It’s been around since at least 2010, and frequently spies on foreign affairs of interest to China.

“Obtaining control of the malicious websites and redirecting traffic from those sites to Microsoft’s secure servers will help us protect existing and future victims while learning more about Nickel’s activities,” wrote Tom Burt, Microsoft’s corporate vice president for customer security and trust. “Our disruption will not prevent Nickel from continuing other hacking activities, but we do believe we have removed a key piece of the infrastructure the group has been relying on for this latest wave of attacks.”

Nickel’s targets, whom Microsoft didn’t name, included some in the U.S.

China has proven difficult to dissuade from conducting cyber-espionage. Even after taking fire this summer from an international coalition that blamed Beijing for exploiting Microsoft Exchange Server flaws in a manner that enabled a ransomware spree across the globe, China has since been tied to numerous other digital snooping campaigns.

Nickel’s techniques vary, but ultimately it has one objective, namely to implant stealthy malware for getting into networks, stealing data and spying, according to Microsoft. Targets for its exploits include Exchange Server and SharePoint systems that users haven’t updated with patches from Microsoft. Nickel also relied on compromised virtual private network suppliers or stolen credentials snatched via spearphishing, the company said.

Besides the U.S., Microsoft said, Nickel has been active in Argentina, Barbados, Bosnia and Herzegovina, Brazil, Bulgaria, Chile, Colombia, Croatia, Czech Republic, Dominican Republic, Ecuador, El Salvador, France, Guatemala, Honduras, Hungary, Italy, Jamaica, Mali, Mexico, Montenegro, Panama, Peru, Portugal, Switzerland, Trinidad and Tobago, the U.K. and Venezuela.

The lawsuit, filed Dec. 2 in the U.S. District Court for the Eastern District of Virginia, is one of 24 from the Microsoft Digital Crimes Unit that has led to the takedown of more than 10,000 malicious websites. Five of the 24 suits were against nation-state groups, Microsoft said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure