Microsoft Takes Control of 99 Domains Operated By Iranian State Hackers

An anonymous reader quotes a report from ZDNet: Court documents unsealed today revealed that Microsoft has been waging a secret battle against a group of Iranian government-sponsored hackers. The OS maker sued and won a restraining order that allowed it to take control of 99 web domains that had been previously owned and operated by a group of Iranian hackers known in cyber-security circles as APT35, Phosphorus, Charming Kitten, and the Ajax Security Team. The domains had been used as part of spear-phishing campaigns aimed at users in the US and across the world.

APT35 hackers had registered these domains to incorporate the names of well-known brands, such as Microsoft, Yahoo, and others. The domains were then used to collect login credentials for users the group had tricked into accessing their sites. The tactic is decades old but is still extremely successful at tricking users into unwittingly disclosing usernames and passwords, even today. Some of the domains Microsoft has confiscated include the likes of outlook-verify.net, yahoo-verify.net, verification-live.com, and myaccount-services.net. Microsoft said it received substantial support from the domain registrars, which transferred the domains over to Microsoft as soon as the company obtained a court order.

Re:

[ClickOnThis]

I thought they liked to be called Persians.

Yes they do. As opposed to Arabs. But they're still Iranians.

Act of War

[quenda]

I hope those Iranian hackers were not trying to sabotage American factories.
Because that would be an illegal act of war, deserving international condemnation and sanctions.

Re:

[Gravis Zero]

I hope those Iranian hackers were not trying to sabotage American factories.

That would be small potatoes and retardedly shortsighted. It's far more likely that they were seeking to get credentials to get deeper access into the workplaces of the targets to copy intellectual property which can cost millions to develop.

Re:

[xenobyte]

I hope those Iranian hackers were not trying to sabotage American factories.

That would be small potatoes and retardedly shortsighted. It's far more likely that they were seeking to get credentials to get deeper access into the workplaces of the targets to copy intellectual property which can cost millions to develop.

Or simply gain a foothold inside vital companies, energy distribution and other essential systems. They could then sabotage their operation as an act of (covert) war. This is pretty much SOP for military intelligence services worldwide and "state hackers" is simply another word for "hackers working for the Iranian military intelligence service".

Re:

[Gravis Zero]

Or simply gain a foothold inside vital companies, energy distribution and other essential systems. They could then sabotage their operation as an act of (covert) war.

Poppycock! We've already seen a worst case scenario for energy distribution systems play out in the US and military systems were not impacted.

Re:

[cyberchondriac]

Did everyone miss the sarcasm here? I believe he was backhandedly referring to the Stuxnet affair, not that I'm sympathetic.

Re:

[quenda]

Did everyone miss the sarcasm here? I believe he was backhandedly referring to the Stuxnet affair, not that I'm sympathetic.

Thanks. Glad somebody is paying attention :-)
I understand the reasons for Stuxnet, but you have to expect some blowback.

This explains things...

[Patent Lover]

I was wondering where IranSaysFuckYouAmerica.com went.

Please sing all together...

[LordHighExecutioner]

99 domains from Iran on the net
Take one down and pass it around, 98 domains from Iran on the net.

98 domains from Iran on the net...