Microsoft announced this week that the company has taken down websites and other online assets used by the Storm-1152 cybercrime group, which the company said is the “number one seller and creator of fraudulent Microsoft accounts.”
Storm-1152, Microsoft said, runs illicit websites and social media pages that sell hacking tools including those aimed at identity verification software.
“We are sending a strong message to those who seek to create, sell or distribute fraudulent Microsoft products for cybercrime: We are watching, taking notice and will act to protect our customers,” stated the company.
“With today’s action, our goal is to deter criminal behavior. By seeking to slow the speed at which cybercriminals launch their attacks, we aim to raise their cost of doing business while continuing our investigation and protecting our customers and other online users,” the company said.
Microsoft moved against Storm-1152 after the company was granted a court order from the Federal court for the Southern District of New York empowering it to seize websites and other online tools that can wreak havoc on customers’ cybersecurity.
Platforms seized via the court order include Hotmailbox.me, 1stCAPTCHA, AnyCAPTCHA, and NoneCAPTCHA, as well as social media sites that actively marketed cybercriminal tools.
“Storm-1152 plays a significant role in the highly specialized cybercrime-as-a-service ecosystem. Cybercriminals need fraudulent accounts to support their largely automated criminal activities,” stated the company.
“For example, Octo Tempest, also known as Scattered Spider, obtained fraudulent Microsoft accounts from Storm-1152. Octo Tempest is a financially motivated cybercrime group that leverages broad social engineering campaigns to compromise organizations across the globe with the goal of financial extortion,” Microsoft said.
“Fraudulent online accounts act as the gateway to a host of cybercrime, including mass phishing, identity theft and fraud, and distributed denial of service (DDoS) attacks,” the company said.
