Microsoft uses court order to shut down APT35 websites

Court orders are becoming an important tool in tech companies’ fight against nation-state-backed hacking groups.

Microsoft has used a court order to wrest control of 99 websites from suspected Iranian hackers that were using them to conduct cyberattacks, court documents unsealed Wednesday show.

The tech giant last week took down websites that were “core to [the] operations” of an Iranian hacking group known as APT35 or Phosphorus, Tom Burt, a Microsoft vice president, wrote in a blog post.

APT35, also known as Charming Kitten, used spoofed websites of well-known companies, including Microsoft and Yahoo, to conduct their malicious activity, he said. But the court order will force the group to recreate some of that infrastructure.

The hackers have sought to steal sensitive information from businesses and government agencies, Burt wrote, though he did not specify the targets by name. APT35 also has a penchant for targeting journalists and activists who focus on Iran. Multiple years of tracking the group allowed Microsoft to build a “decisive legal case” against the hackers which was heard in the U.S. District Court for Washington D.C, he added.

The intelligence gathered from the “sinkholing” of the malicious sites will be added to Microsoft’s case file on the group and used to strengthen the company’s security tools, Burt wrote.

Court orders are an important part of tech companies’ fight against alleged nation-state-backed groups that use the companies’ technology for cyber operations. Last August, Microsoft announced the takedown of six internet domains set up by Russian-government-linked Fancy Bear or APT 28.

News of the Microsoft action against APT35 came the same day as researchers from Symantec published research on another Iranian hacking group, APT33, that has used its skills to spy on a plethora of organizations in Saudi Arabia and the U.S.

Iranian hackers using social media, job recruitment sites to lure Israeli spies

Mandiant says the primary motive for the operation appears to be helping the Iranian government identify Iranians who may cooperate with Israel.

Iranian hackers ‘tickle’ targets in US, UAE with custom tool, Microsoft says

Microsoft seizes domain used by Vietnamese group to sell fake accounts, services 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure