{"id":3423,"date":"2026-05-21T09:02:52","date_gmt":"2026-05-21T16:02:52","guid":{"rendered":"https:\/\/celacampaig.wpenginepowered.com\/?page_id=3423"},"modified":"2026-05-21T09:09:20","modified_gmt":"2026-05-21T16:09:20","slug":"disrupting-cyberthreats-since-2008","status":"publish","type":"page","link":"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/","title":{"rendered":"Disrupting cyberthreats since 2008"},"content":{"rendered":"<div data-bi-ct=\"group\" class=\"wp-block-group alignfull microsoft-breakpoint-id-yllkqo37a has-global-padding is-layout-constrained wp-container-core-group-is-layout-19e250f3 wp-block-group-is-layout-constrained\" data-microsoft-breakpoint-id=\"yllkqo37a\"><div class=\"wp-block-cover alignfull\" style=\"padding-top:var(--wp--preset--spacing--2-xl-fluid);padding-bottom:var(--wp--preset--spacing--2-xl-fluid);min-height:425px;aspect-ratio:unset;\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" class=\"wp-block-cover__image-background wp-image-3424 size-large\" alt=\"\" src=\"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-1024x576.jpg\" data-object-fit=\"cover\" srcset=\"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-1024x576.jpg 1024w, https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-300x169.jpg 300w, https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-768x432.jpg 768w, https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-1536x864.jpg 1536w, https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\"><span aria-hidden=\"true\" class=\"wp-block-cover__background has-background-dim-70 has-background-dim\" style=\"background-color:#072a4a\"><\/span><div class=\"wp-block-cover__inner-container has-global-padding is-layout-constrained wp-block-cover-is-layout-constrained\"><div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer block-visibility-hide-large-screen block-visibility-hide-medium-screen\"><\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group alignwide microsoft-breakpoint-id-f47tzr7wk is-layout-grid wp-container-core-group-is-layout-f1a35b18 wp-block-group-is-layout-grid\" data-microsoft-breakpoint-id=\"f47tzr7wk\"><h1 style=\"font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px);\" class=\"wp-block-post-title\">Disrupting cyberthreats since 2008<\/h1>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-kdxdwtmf1 is-layout-flow wp-container-core-group-is-layout-36baf07f wp-block-group-is-layout-flow\" data-microsoft-breakpoint-id=\"kdxdwtmf1\"><p class=\"wp-block-paragraph\" style=\"font-size:clamp(15.747px, 0.984rem + ((1vw - 3.9px) * 0.779), 24px);\">For more than a decade,&nbsp;the&nbsp;Microsoft&nbsp;Digital Crimes Unit (DCU)&nbsp;has persistently disrupted cybercrime and&nbsp;nation-state&nbsp;threats targeting people,&nbsp;organizations,&nbsp;and critical infrastructure.&nbsp;Explore major disruptions&mdash;and the&nbsp;ongoing&nbsp;cases and operations behind&nbsp;them.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"border-top-color:var(--wp--preset--color--white);border-top-width:2px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text-alt\"><a data-bi-ct=\"button\" class=\"wp-block-button__link has-body-large-fluid-font-size has-custom-font-size wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/customer-security-trust\/digital-crimes-unit\" data-bi-cn=\"Learn more about the Digital Crimes Unit\">Learn more about the Digital Crimes Unit<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" style=\"width: 1em;\" focusable=\"false\" aria-hidden=\"true\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group alignfull microsoft-breakpoint-id-vvj6ei5wp has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"padding-top:var(--wp--preset--spacing--2-xl-fluid);padding-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"vvj6ei5wp\"><div style=\"--tag-id-bg-tag-k0jvx7t: #8dc8e8; --tag-id-fg-tag-k0jvx7t: #000; --tag-id-bg-tag-duhcisk: #b9dcd2; --tag-id-fg-tag-duhcisk: #000; --tag-id-bg-tag-cos2gjr: #c5b4e3; --tag-id-fg-tag-cos2gjr: var(--tag-fg-background); --tag-id-bg-tag-3gf5rgd: #ffa38b; --tag-id-fg-tag-3gf5rgd: var(--tag-fg-background); --tag-id-bg-tag-30wvzs9: #a0d2c7; --tag-id-fg-tag-30wvzs9: var(--tag-fg-background); --tag-id-bg-tag-5utjqi0: #ffe399; --tag-id-fg-tag-5utjqi0: var(--tag-fg-background)\" class=\"alignwide wp-block-microsoft-timeline-timeline\" aria-live=\"polite\">\n\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-kwvndwstv wp-container-content-e29552f7 is-nowrap is-layout-flex wp-container-core-group-is-layout-f66f9956 wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"kwvndwstv\"><div class=\"wp-block-microsoft-timeline-timeline-years\" data-mode=\"multi\">\n\t<dl class=\"timeline__line\">\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2026\">\n\t\t\t\t\t\t<span>2026<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#tycoon-2fa\" aria-label=\"Navigate to Tycoon 2FA\" data-event-index=\"0\" class=\"is-selected\" aria-current=\"true\" data-bi-cn=\"Navigate to Tycoon 2FA\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#tycoon-2fa\" aria-label=\"Navigate to Tycoon 2FA\" data-event-index=\"1\" data-bi-cn=\"Navigate to Tycoon 2FA\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#redvds\" aria-label=\"Navigate to RedVDS\" data-event-index=\"2\" data-bi-cn=\"Navigate to RedVDS\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2025\">\n\t\t\t\t\t\t<span>2025<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#raccoono365\" aria-label=\"Navigate to RaccoonO365\" data-event-index=\"3\" data-bi-cn=\"Navigate to RaccoonO365\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#lumma-stealer\" aria-label=\"Navigate to Lumma Stealer\" data-event-index=\"4\" data-bi-cn=\"Navigate to Lumma Stealer\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2024\">\n\t\t\t\t\t\t<span>2024<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#fizzdogg\" aria-label=\"Navigate to FizzDogg\" data-event-index=\"5\" data-bi-cn=\"Navigate to FizzDogg\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#fake-onnx\" aria-label=\"Navigate to Fake ONNX\" data-event-index=\"6\" data-bi-cn=\"Navigate to Fake ONNX\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#star-blizzard\" aria-label=\"Navigate to Star Blizzard\" data-event-index=\"7\" data-bi-cn=\"Navigate to Star Blizzard\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2023\">\n\t\t\t\t\t\t<span>2023<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#storm-1152\" aria-label=\"Navigate to Storm-1152\" data-event-index=\"8\" data-bi-cn=\"Navigate to Storm-1152\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#cracked-cobalt-strike\" aria-label=\"Navigate to Cracked Cobalt Strike\" data-event-index=\"9\" data-bi-cn=\"Navigate to Cracked Cobalt Strike\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2022\">\n\t\t\t\t\t\t<span>2022<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#smoke-sandstorm\" aria-label=\"Navigate to Smoke Sandstorm\" data-event-index=\"10\" data-bi-cn=\"Navigate to Smoke Sandstorm\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#zloader\" aria-label=\"Navigate to ZLoader\" data-event-index=\"11\" data-bi-cn=\"Navigate to ZLoader\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2021\">\n\t\t\t\t\t\t<span>2021<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#nylon-typhoon\" aria-label=\"Navigate to Nylon Typhoon\" data-event-index=\"12\" data-bi-cn=\"Navigate to Nylon Typhoon\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#emotet\" aria-label=\"Navigate to Emotet\" data-event-index=\"13\" data-bi-cn=\"Navigate to Emotet\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2020\">\n\t\t\t\t\t\t<span>2020<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#trickbot\" aria-label=\"Navigate to Trickbot\" data-event-index=\"14\" data-bi-cn=\"Navigate to Trickbot\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#trickbot\" aria-label=\"Navigate to Trickbot\" data-event-index=\"15\" data-bi-cn=\"Navigate to Trickbot\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#necurs\" aria-label=\"Navigate to Necurs\" data-event-index=\"16\" data-bi-cn=\"Navigate to Necurs\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2019\">\n\t\t\t\t\t\t<span>2019<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#emerald-sleet\" aria-label=\"Navigate to Emerald Sleet\" data-event-index=\"17\" data-bi-cn=\"Navigate to Emerald Sleet\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#mint-sandstorm\" aria-label=\"Navigate to Mint Sandstorm\" data-event-index=\"18\" data-bi-cn=\"Navigate to Mint Sandstorm\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2018\">\n\t\t\t\t\t\t<span>2018<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2017\">\n\t\t\t\t\t\t<span>2017<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#gamarue\" aria-label=\"Navigate to Gamarue\" data-event-index=\"19\" data-bi-cn=\"Navigate to Gamarue\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#avalanche\" aria-label=\"Navigate to Avalanche\" data-event-index=\"20\" data-bi-cn=\"Navigate to Avalanche\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#brass-typhoon\" aria-label=\"Navigate to Brass Typhoon\" data-event-index=\"21\" data-bi-cn=\"Navigate to Brass Typhoon\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 1\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2016\">\n\t\t\t\t\t\t<span>2016<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#forest-blizzard\" aria-label=\"Navigate to Forest Blizzard\" data-event-index=\"22\" data-bi-cn=\"Navigate to Forest Blizzard\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2015\">\n\t\t\t\t\t\t<span>2015<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#dorkbot\" aria-label=\"Navigate to Dorkbot\" data-event-index=\"23\" data-bi-cn=\"Navigate to Dorkbot\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#simda\" aria-label=\"Navigate to Simda\" data-event-index=\"24\" data-bi-cn=\"Navigate to Simda\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#ramnit\" aria-label=\"Navigate to Ramnit\" data-event-index=\"25\" data-bi-cn=\"Navigate to Ramnit\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2014\">\n\t\t\t\t\t\t<span>2014<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#caphaw\" aria-label=\"Navigate to Caphaw\" data-event-index=\"26\" data-bi-cn=\"Navigate to Caphaw\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#gameover-zeus\" aria-label=\"Navigate to GameOver Zeus\" data-event-index=\"27\" data-bi-cn=\"Navigate to GameOver Zeus\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#bladabindi-jenxcus\" aria-label=\"Navigate to Bladabindi &amp; Jenxcus\" data-event-index=\"28\" data-bi-cn=\"Navigate to Bladabindi &amp;amp; Jenxcus\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 3\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2013\">\n\t\t\t\t\t\t<span>2013<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#zeroaccess\" aria-label=\"Navigate to ZeroAccess\" data-event-index=\"29\" data-bi-cn=\"Navigate to ZeroAccess\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#citadel\" aria-label=\"Navigate to Citadel\" data-event-index=\"30\" data-bi-cn=\"Navigate to Citadel\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 3\">\n\t\t\t\t\t\t<a href=\"#bamital\" aria-label=\"Navigate to Bamital\" data-event-index=\"31\" data-bi-cn=\"Navigate to Bamital\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2012\">\n\t\t\t\t\t\t<span>2012<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#nitol\" aria-label=\"Navigate to Nitol\" data-event-index=\"32\" data-bi-cn=\"Navigate to Nitol\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#zeus\" aria-label=\"Navigate to Zeus\" data-event-index=\"33\" data-bi-cn=\"Navigate to Zeus\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2011\">\n\t\t\t\t\t\t<span>2011<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#kelihos\" aria-label=\"Navigate to Kelihos\" data-event-index=\"34\" data-bi-cn=\"Navigate to Kelihos\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#rustock\" aria-label=\"Navigate to Rustock\" data-event-index=\"35\" data-bi-cn=\"Navigate to Rustock\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"timeline__group\" style=\"--timeline-events-per-group: 2\">\n\t\t\t\t<dt class=\"timeline__year\">\n\t\t\t\t\t<time datetime=\"2010\">\n\t\t\t\t\t\t<span>2010<\/span>\n\t\t\t\t\t<\/time>\n\t\t\t\t<\/dt>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 1\">\n\t\t\t\t\t\t<a href=\"#conficker\" aria-label=\"Navigate to Conficker\" data-event-index=\"36\" data-bi-cn=\"Navigate to Conficker\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<dd class=\"timeline__events\" style=\"--timeline-event-index: 2\">\n\t\t\t\t\t\t<a href=\"#waledac\" aria-label=\"Navigate to Waledac\" data-event-index=\"37\" data-bi-cn=\"Navigate to Waledac\">\n\t\t\t\t\t\t\t<span class=\"marker\"><\/span>\n\t\t\t\t\t\t<\/a>\n\t\t\t\t\t<\/dd>\n\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t<\/dl>\n\t\t<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-pqqqy202u is-vertical is-content-justification-left is-layout-flex wp-container-core-group-is-layout-c6e5b353 wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"pqqqy202u\"><div data-bi-ct=\"group\" class=\"wp-block-group has-white-background-color has-background microsoft-breakpoint-id-pc7hi907a is-layout-flow wp-block-group-is-layout-flow wp-container-8 is-position-sticky\" style=\"padding-bottom:var(--wp--preset--spacing--sm)\" data-microsoft-breakpoint-id=\"pc7hi907a\"><div class=\"wp-block-microsoft-timeline-timeline-search\" data-search-config='{\"inputId\":\"timeline-search-input-1\",\"statusId\":\"timeline-search-status-2\",\"label\":\"Search events\",\"placeholder\":\"Type to search\\u2026\",\"clearLabel\":\"Clear search\",\"fields\":[\"label\",\"body\",\"tags\"]}'><\/div>\n\n\n<div class=\"wp-block-microsoft-timeline-timeline-filters has-body-xs-font-size\" role=\"group\" aria-labelledby=\"timeline-filters-label-4\">\n\t<p id=\"timeline-filters-label-4\" class=\"wp-block-microsoft-timeline-timeline-filters__label\">\n\t\tFilter by tag\t<\/p>\n\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__trigger\" aria-haspopup=\"listbox\" aria-expanded=\"false\" aria-controls=\"timeline-filters-listbox-6\">\n\t\t<span class=\"wp-block-microsoft-timeline-timeline-filters__trigger-label\">\n\t\t\tFilter by tag\t\t<\/span>\n\t\t<span class=\"wp-block-microsoft-timeline-timeline-filters__trigger-count\" aria-hidden=\"true\" hidden><\/span>\n\t<\/button>\n\t<ul id=\"timeline-filters-listbox-6\" class=\"wp-block-microsoft-timeline-timeline-filters__tags\">\n\t\t<li>\n\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button is-all\" data-tag-slug=\"all\">\n\t\t\t\tAll\t\t\t<\/button>\n\t\t<\/li>\n\t\t\t\t\t\t\t\t<li>\n\t\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button\" data-tag-slug=\"ransomware\" style=\"--filter-bg: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);--filter-fg: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\">\n\t\t\t\t\tRansomware\t\t\t\t<\/button>\n\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li>\n\t\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button\" data-tag-slug=\"cybercrime-tools-and-services\" style=\"--filter-bg: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);--filter-fg: var(--tag-id-fg-tag-k0jvx7t, #000)\">\n\t\t\t\t\tCybercrime tools and services\t\t\t\t<\/button>\n\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li>\n\t\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button\" data-tag-slug=\"malware\" style=\"--filter-bg: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);--filter-fg: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\">\n\t\t\t\t\tMalware\t\t\t\t<\/button>\n\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li>\n\t\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button\" data-tag-slug=\"fraud\" style=\"--filter-bg: var(--tag-id-bg-tag-duhcisk, #b9dcd2);--filter-fg: var(--tag-id-fg-tag-duhcisk, #000)\">\n\t\t\t\t\tFraud\t\t\t\t<\/button>\n\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li>\n\t\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button\" data-tag-slug=\"ai-abuse\" style=\"--filter-bg: var(--tag-id-bg-tag-cos2gjr, #c5b4e3);--filter-fg: var(--tag-id-fg-tag-cos2gjr, var(--tag-fg-fallback))\">\n\t\t\t\t\tAI abuse\t\t\t\t<\/button>\n\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li>\n\t\t\t\t<button type=\"button\" class=\"wp-block-microsoft-timeline-timeline-filters__button\" data-tag-slug=\"nation-state\" style=\"--filter-bg: var(--tag-id-bg-tag-5utjqi0, #ffe399);--filter-fg: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\">\n\t\t\t\t\tnation-state\t\t\t\t<\/button>\n\t\t\t<\/li>\n\t\t\t<\/ul>\n\t<p id=\"timeline-filters-status-5\" class=\"wp-block-microsoft-timeline-timeline-filters__status screen-reader-text\" aria-live=\"polite\"><\/p>\n<\/div>\n<\/div>\n\n\n<div style=\"height:0px\" aria-hidden=\"true\" class=\"wp-block-spacer wp-container-content-9760934e\"><\/div>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"tycoon-2fa\" data-tags='[\"ransomware\",\"cybercrime-tools-and-services\",\"malware\"]' data-search=\"tycoon 2fa ransomware cybercrime tools and services malware fox tempest ransomware cybercrime tools and services malware fox tempest is a sophisticated cybercrime operation that abused malicious code signing and trusted development infrastructure to enable the deployment of malicious code&mdash;including ransomware&mdash;at scale. by exploiting trust in signed artifacts, the actors increased the likelihood that their payloads would evade detection and execute across enterprise and critical envir\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">May 2026<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Fox Tempest<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-56p16jnyx has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"56p16jnyx\"><p class=\"has-text-align-left wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Fox Tempest is a sophisticated cybercrime operation that abused malicious code signing and trusted development infrastructure to enable the deployment of malicious code&mdash;including ransomware&mdash;at scale. By exploiting trust in signed artifacts, the actors increased the likelihood that their payloads would evade detection and execute across enterprise and critical environments worldwide.<\/p>\n\n\n<p class=\"has-text-align-left wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Recognizing the risk posed by this activity, Microsoft&rsquo;s Digital Crimes Unit (DCU), in coordination with global partners, pursued a civil legal and technical disruption. Through court-authorized action, Microsoft seized online infrastructure supporting the operation and took steps to limit the actor&rsquo;s ability to abuse Microsoft&rsquo;s artifact signing services. DCU also shared extensive information regarding this threat with law enforcement globally. These actions disrupted the service&rsquo;s infrastructure and reduced the actor&rsquo;s ability to leverage trusted signing mechanisms at scale.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/aka.ms\/FOX-Tempest-disruption\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noopener noreferrer\" data-bi-cn=\"Read&nbsp;more about&nbsp;how the DCU disrupted&nbsp;Fox Tempest\">Read&nbsp;more about&nbsp;how the DCU disrupted&nbsp;Fox Tempest<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"tycoon-2fa\" data-tags='[\"cybercrime-tools-and-services\",\"fraud\"]' data-search=\"tycoon 2fa cybercrime tools and services fraud tycoon 2fa cybercrime tools and services fraud cybercriminals&nbsp;operating tycoon&#8239;2fa ran one of the world&rsquo;s largest phishing&#8209;as&#8209;a&#8209;service operations, enabling impersonation attacks that bypassed multi-factor authentication and turned stolen identities into&nbsp;access for fraud, data theft, and ransomware. the service fueled tens of millions of malicious emails each month,&nbsp;impacting&nbsp;an estimated&nbsp;96,000\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">February 2026<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Tycoon 2FA<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-56p16jnyx has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"56p16jnyx\"><p class=\"has-text-align-left wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Cybercriminals&nbsp;operating Tycoon&#8239;2FA ran one of the world&rsquo;s largest phishing&#8209;as&#8209;a&#8209;service operations, enabling impersonation attacks that bypassed multi-factor authentication and turned stolen identities into&nbsp;access for fraud, data theft, and ransomware. The service fueled tens of millions of malicious emails each month,&nbsp;impacting&nbsp;an estimated&nbsp;96,000 victims&nbsp;since 2023&mdash;including&nbsp;over&nbsp;55,000 Microsoft customers&mdash;with healthcare and education organizations hit hardest, causing disruptions, delayed care, and financial losses. In a coordinated public&#8209;private action,&nbsp;the DCU, Europol, and global law&nbsp;enforcement seized 330 domains tied to Tycoon&#8239;2FA&rsquo;s core infrastructure, cutting off a major pipeline for identity&#8209;based abuse. Industry partners expanded telemetry and victim insights, while cross&#8209;border coordination accelerated takedowns, underscoring how sustained, ecosystem&#8209;wide disruption&mdash;especially as cybercrime scales through AI&mdash;can measurably reduce harm and raise the cost of cybercrime.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2026\/03\/04\/how-a-global-coalition-disrupted-tycoon\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;more about&nbsp;how the DCU disrupted&nbsp;Tycoon 2FA&nbsp;\">Read&nbsp;more about&nbsp;how the DCU disrupted&nbsp;Tycoon 2FA&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/tycoon2fa\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more&nbsp;about the legal action against&nbsp;Tycoon 2FA\">Learn more&nbsp;about the legal action against&nbsp;Tycoon 2FA<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"redvds\" data-tags='[\"cybercrime-tools-and-services\",\"fraud\",\"ai-abuse\"]' data-search=\"redvds cybercrime tools and services fraud ai abuse redvds cybercrime tools and services fraud ai abuse redvds operated as a cybercrime-as-a-service (caas) platform, providing cybercriminals with cheap, disposable, and unlicensed windows-based virtual desktops that enabled large-scale phishing, business email compromise (bec), account takeover, and fraud, augmented with generative ai tools to identify targets and create impersonation content. since march 2025, redvds-enabled activity drove appro\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">January 2026<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">RedVDS<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-cos2gjr, #c5b4e3);color: var(--tag-id-fg-tag-cos2gjr, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-cos2gjr\">\n\tAI abuse<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-g2m6piisc has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"g2m6piisc\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">RedVDS operated as a Cybercrime-as-a-Service (CaaS) platform, providing cybercriminals with cheap, disposable, and unlicensed Windows-based virtual desktops that enabled large-scale phishing, business email compromise (BEC), account takeover, and fraud, augmented with generative AI tools to identify targets and create impersonation content. Since March 2025, RedVDS-enabled activity drove approx. $70 million in reported fraud losses in the US alone, impacting individuals and organizations in sectors like healthcare, real estate, and financial services, including a pharmaceutical company that lost $7.3 million in a single BEC incident. In response, the DCU&mdash;working with law enforcement in the US, UK, Germany, and Europol, and supported by private-sector partners&mdash;executed coordinated legal and technical actions to seize RedVDS infrastructure, take its marketplaces and customer portals down, and dismantle its core operating model, disrupting a key enabler of global cyber-enabled fraud at scale.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2026\/01\/14\/microsoft-disrupts-cybercrime\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;more about&nbsp;how the DCU disrupted RedVDS\">Read&nbsp;more about&nbsp;how the DCU disrupted RedVDS<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.net\/redvds\/index.html\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more&nbsp;about the legal action against RedVDS\">Learn more&nbsp;about the legal action against RedVDS<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"raccoono365\" data-tags='[\"cybercrime-tools-and-services\",\"fraud\",\"ai-abuse\"]' data-search=\"raccoono365 cybercrime tools and services fraud ai abuse raccoono365 cybercrime tools and services fraud ai abuse raccoono365 was a fast&#8209;growing phishing&#8209;as&#8209;a&#8209;service operation that sold ready&#8209;made kits spoofing microsoft branding, sign&#8209;in pages, and emails&mdash;enabling criminals to steal at least 5,000 microsoft 365 credentials across 94 countries since july 2024. as the service evolved, its operators launched a new ai&#8209;powered offering to further scal\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">September 2025<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">RaccoonO365<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-cos2gjr, #c5b4e3);color: var(--tag-id-fg-tag-cos2gjr, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-cos2gjr\">\n\tAI abuse<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-sq6wq89r5 has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"sq6wq89r5\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">RaccoonO365 was a fast&#8209;growing phishing&#8209;as&#8209;a&#8209;service operation that sold ready&#8209;made kits spoofing Microsoft branding, sign&#8209;in pages, and emails&mdash;enabling criminals to steal at least 5,000 Microsoft 365 credentials across 94 countries since July 2024. As the service evolved, its operators launched a new AI&#8209;powered offering to further scale phishing campaigns. The DCU identified RaccoonO365 as a high&#8209;velocity threat and, working with Health&#8209;ISAC due to risks to the healthcare sector, obtained a court order from the US District Court for the Southern District of NY to seize 338 malicious domains while coordinating with Cloudflare to dismantle evasive infrastructure. These actions severed the connection between attackers and victims, disrupted the monetization of stolen credentials, and raised costs for the phishing economy. In December 2025, investigations with global partners led to arrests in Nigeria linked to RaccoonO365, reinforcing the impact of public&#8209;private disruption efforts.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"http:\/\/aka.ms\/RacoonO365-blog\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;more about&nbsp;how the DCU disrupted RaccoonO365\">Read&nbsp;more about&nbsp;how the DCU disrupted RaccoonO365<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/RaccoonO365\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against RaccoonO365\">Learn more about the legal action against RaccoonO365<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/stories\/raccoono365\/\" style=\"font-style:normal;font-weight:600\" data-bi-cn=\"Explore how we disrupted RaccoonO365\">Explore how we disrupted RaccoonO365<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"lumma-stealer\" data-tags='[\"malware\",\"ransomware\",\"cybercrime-tools-and-services\"]' data-search=\"lumma stealer malware ransomware cybercrime tools and services lumma&nbsp;stealer malware ransomware cybercrime tools and services lumma stealer is a malware&#8209;as&#8209;a&#8209;service (maas) tool used by hundreds of cybercriminals to steal credentials, financial data, and cryptocurrency wallets, enabling ransomware, fraud, and other attacks. from march&ndash;may 2025, 394,000+ windows devices were infected, impacting consumers, schools, and organizations across finance, logistics, and other\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">May 2025<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Lumma&nbsp;Stealer<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-71cf6em6k has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"71cf6em6k\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Lumma Stealer is a Malware&#8209;as&#8209;a&#8209;Service (MaaS) tool used by hundreds of cybercriminals to steal credentials, financial data, and cryptocurrency wallets, enabling ransomware, fraud, and other attacks. From March&ndash;May 2025, 394,000+ Windows devices were infected, impacting consumers, schools, and organizations across finance, logistics, and other sectors, with losses ranging from emptied bank accounts to service disruption. In a coordinated response, the DCU&mdash;working with the US Dept. of Justice, Europol EC3, Japan&rsquo;s JC3, and private&#8209;sector partners like Cloudflare, ESET, Lumen, and key domain registries&mdash;seized ~2,300 malicious domains, dismantled Lumma&rsquo;s infrastructure and marketplaces, and redirected 1,300+ domains to to Microsoft sinkholes, significantly degrading the malware&rsquo;s ecosystem and criminal revenue. The DCU&rsquo;s disruption of Lumma remains ongoing, with the threat now integrated into Microsoft&rsquo;s Statutory Automated Disruption program to sustain pressure and prevent reconstitution.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2025\/05\/21\/microsoft-leads-global-action-against-favored-cybercrime-tool\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Lumma Stealer\">Read more about how the DCU disrupted Lumma Stealer<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.net\/lumma\/index.html\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Lumma Stealer\">Learn more about the legal action against Lumma Stealer<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"fizzdogg\" data-tags='[\"ai-abuse\",\"cybercrime-tools-and-services\"]' data-search=\"fizzdogg ai abuse cybercrime tools and services fizzdogg ai abuse cybercrime tools and services fizzdogg, also tracked as storm-2139, was an abuse operation that exploited stolen azure openai api keys to generate and distribute offensive content, including non-consensual intimate images of celebrities and other sexually explicit materials, violating microsoft&rsquo;s terms of use and undermining trust in ai services. the dcu identified the group as an &ldquo;ai-abuse-as-a-service&rdquo; provider\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">December 2024<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">FizzDogg<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-cos2gjr, #c5b4e3);color: var(--tag-id-fg-tag-cos2gjr, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-cos2gjr\">\n\tAI abuse<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-xsbb7d73v has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"xsbb7d73v\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">FizzDogg, also tracked as Storm-2139, was an abuse operation that exploited stolen Azure OpenAI API keys to generate and distribute offensive content, including non-consensual intimate images of celebrities and other sexually explicit materials, violating Microsoft&rsquo;s Terms of Use and undermining trust in AI services. The DCU identified the group as an &ldquo;AI-abuse-as-a-service&rdquo; provider that used credential theft and layered infrastructure to bypass safety safeguards. To neutralize this threat, the DCU led a coordinated legal and technical disruption, securing a court order to seize the domains used to sell unauthorized AI access and automate the abuse. By dismantling this system, the DCU severed the group&rsquo;s revenue streams and curtailed its ability to weaponize generative AI. This intervention protected the integrity of AI services and demonstrated Microsoft&rsquo;s commitment to enforcing the responsible use of AI while raising costs for actors attempting to exploit emerging technologies.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2025\/01\/10\/taking-legal-action-to-protect-the-public-from-abusive-ai-generated-content\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the DCU&rsquo;s initial legal action against FizzDogg\">Read more about the DCU&rsquo;s initial legal action against FizzDogg<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2025\/02\/27\/disrupting-cybercrime-abusing-gen-ai\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the DCU&rsquo;s amended complaint and naming of defendants\">Read more about the DCU&rsquo;s amended complaint and naming of defendants<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/news.microsoft.com\/source\/features\/ai\/how-microsoft-is-taking-down-ai-hackers-who-create-harmful-images-of-celebrities-and-others\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how Microsoft protects digital safety\">Read more about how Microsoft protects digital safety<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.net\/fizzdog\/index.html\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against FizzDogg\">Learn more about the legal action against FizzDogg<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"fake-onnx\" data-tags='[\"cybercrime-tools-and-services\",\"fraud\"]' data-search=\"fake onnx cybercrime tools and services fraud fake onnx cybercrime tools and services fraud fake onnx, also tracked as caffeine, was a phishing-as-a-service&nbsp;(paas)&#8239; operation that sold &ldquo;do-it-yourself&rdquo; kits enabling adversary-in-the-middle attacks to bypass multifactor authentication and drive large-scale account takeovers. victims across sectors&mdash;especially financial services&mdash;suffered stolen credentials and downstream harm, including financial fraud, data theft\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">November 2024<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Fake ONNX<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-31jo6h9d5 has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"31jo6h9d5\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Fake ONNX, also tracked as Caffeine, was a Phishing-as-a-Service&nbsp;(PaaS)&#8239; operation that sold &ldquo;do-it-yourself&rdquo; kits enabling adversary-in-the-middle attacks to bypass multifactor authentication and drive large-scale account takeovers. Victims across sectors&mdash;especially financial services&mdash;suffered stolen credentials and downstream harm, including financial fraud, data theft, and ransomware, with some losing substantial sums of money that could be difficult to recover. To disrupt the cybercrime supply chain, the DCU, alongside LF Projects (Linux Foundation), secured a court order to seize 240 fraudulent domains tied to the operation&rsquo;s storefronts and infrastructure, cutting off access to the kits and raising the cost of abuse. Accountability followed: in February 2026, Egypt&rsquo;s Economic Court sentenced Abanoub Nady and other members of the cybercrime group to two to three years&rsquo; imprisonment and fines of approximately USD&#8239;$30,000.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2024\/11\/21\/targeting-the-cybercrime-supply-chain\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Fake ONXX\">Read more about how the DCU disrupted Fake ONXX<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/fakeonnx\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Fake ONXX\">Learn more about the legal action against Fake ONXX<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"star-blizzard\" data-tags='[\"nation-state\"]' data-search=\"star blizzard nation-state star blizzard nation-state star blizzard is a russian state-affiliated actor that targets government officials and ngos through sophisticated spear-phishing to undermine democratic processes. the dcu identified the group as a primary threat to global civil society and spearheaded a legal intervention to dismantle its operations. joined by the ngo-isac, the dcu secured a federal court order to seize 66 domains while coordinating with the us department of justice to neut\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">September 2024<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Star Blizzard<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-308drmel5 has-global-padding is-layout-constrained wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"308drmel5\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Star Blizzard is a Russian state-affiliated actor that targets government officials and NGOs through sophisticated spear-phishing to undermine democratic processes. The DCU identified the group as a primary threat to global civil society and spearheaded a legal intervention to dismantle its operations. Joined by the NGO-ISAC, the DCU secured a federal court order to seize 66 domains while coordinating with the US Department of Justice to neutralize over 100 malicious sites. This disruption shielded thousands of targets and increased operational costs for the actor. By disabling this infrastructure, the DCU reinforced international norms and provided vital protection for organizations critical to democratic stability.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2024\/10\/03\/protecting-democratic-institutions-from-cyber-threats\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Star Blizzard\">Read more about how the DCU disrupted Star Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2025\/01\/16\/new-star-blizzard-spear-phishing-campaign-targets-whatsapp-accounts\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about Microsoft Threat Intelligence research into Star Blizzard\">Read more about Microsoft Threat Intelligence research into Star Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/starblizzard\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Star Blizzard\">Learn more about the legal action against Star Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"storm-1152\" data-tags='[\"fraud\",\"ai-abuse\",\"cybercrime-tools-and-services\"]' data-search=\"storm-1152 fraud ai abuse cybercrime tools and services storm-1152 fraud ai abuse cybercrime tools and services storm-1152, based in vietnam, was a major cybercrime-as-a-service&nbsp;(caas) operation selling fraudulent microsoft accounts and tools to bypass identity and captcha safeguards. the actor used automation and ai-assisted techniques to scale account creation, adapt to defensive controls, and evade detection&mdash;reducing the cost and effort for criminals to conduct phishing, spam, rans\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">September 2023<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Storm-1152<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-cos2gjr, #c5b4e3);color: var(--tag-id-fg-tag-cos2gjr, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-cos2gjr\">\n\tAI abuse<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Storm-1152, based in Vietnam, was a major Cybercrime-as-a-Service&nbsp;(CaaS) operation selling fraudulent Microsoft accounts and tools to bypass identity and CAPTCHA safeguards. The actor used automation and AI-assisted techniques to scale account creation, adapt to defensive controls, and evade detection&mdash;reducing the cost and effort for criminals to conduct phishing, spam, ransomware, extortion, and DDoS campaigns. Storm-1152 created ~750 million fraudulent Microsoft accounts, generating millions in illicit revenue while imposing fraud, security, and operational costs across the digital ecosystem. Threat actors such as Octo Tempest (Scattered Spider) relied on Storm-1152-supplied accounts to support social engineering and financial extortion campaigns. To disrupt these activities, the DCU&mdash;working with Arkose Labs and cross-functional Microsoft teams&mdash;combined AI detection and legal action to seize Storm-1152&rsquo;s infrastructure, reducing fraudulent sign-ups by ~60% and degrading its operations.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2023\/12\/13\/cybercrime-cybersecurity-storm-1152-fraudulent-accounts\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Storm-1152\">Read more about how the DCU disrupted Storm-1152<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/landingpage-h0gcc3bvhkd2aaez.z01.azurefd.net\/notice-of-pleadings\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Storm-1152\">Learn more about the legal action against Storm-1152<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"cracked-cobalt-strike\" data-tags='[\"cybercrime-tools-and-services\",\"ransomware\",\"malware\"]' data-search=\"cracked cobalt strike cybercrime tools and services ransomware malware cracked cobalt strike cybercrime tools and services ransomware malware cobalt strike is a commercially available penetration-testing tool originally built for security professionals to simulate cyberattacks and identify network vulnerabilities. unfortunately, unauthorized, &ldquo;cracked&rdquo; versions of the tool have become a preferred way for ransomware groups and nation-state actors to deploy malware. the dcu identified \">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">April 2023<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Cracked Cobalt Strike<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Cobalt Strike is a commercially available penetration-testing tool originally built for security professionals to simulate cyberattacks and identify network vulnerabilities. Unfortunately, unauthorized, &ldquo;cracked&rdquo; versions of the tool have become a preferred way for ransomware groups and nation-state actors to deploy malware. The DCU identified the widespread abuse of this software as a critical factor in high-impact intrusions across the globe. To blunt this threat, the DCU spearheaded a first-of-its-kind legal action with Fortra and Health-ISAC, obtaining a court order to disrupt the malicious infrastructure hosting cracked legacy versions of Cobalt Strike. Recognizing the need to continue pressure on the ecosystem, DCU continuously identifies and disrupts newly stood-up infrastructure as it emerges through its Statutory Automated Disruption (SAD) and Court Monitor programs.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2023\/04\/06\/stopping-cybercriminals-from-abusing-security-tools\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;cracked Cobalt Strike\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;cracked Cobalt Strike<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/news.microsoft.com\/signalmagazine\/issue\/issue-02\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU helped the Irish healthcare system\">Read more about how the DCU helped the Irish healthcare system<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.com\/crackedcobaltstrike\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against&#8239;cracked Cobalt Strike\">Learn more about the legal action against&#8239;cracked Cobalt Strike<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"smoke-sandstorm\" data-tags='[\"nation-state\"]' data-search=\"smoke sandstorm nation-state smoke sandstorm nation-state smoke sandstorm, also tracked as bohrium, is an iran-based threat actor that conducted strategic espionage and disruptive operations against the government, transportation, and technology sectors. the group utilized spear-phishing and custom malware to harvest credentials and maintain persistence within critical networks. microsoft identified these activities as a significant risk to regional stability, resulting in the dcu taking legal a\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">May 2022<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Smoke Sandstorm<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Smoke Sandstorm, also tracked as Bohrium, is an Iran-based threat actor that conducted strategic espionage and disruptive operations against the government, transportation, and technology sectors. The group utilized spear-phishing and custom malware to harvest credentials and maintain persistence within critical networks. Microsoft identified these activities as a significant risk to regional stability, resulting in the DCU taking legal action to neutralize the threat. By securing a federal court order, the DCU seized the malicious domains used for command-and-control while a Court Monitor program allowed the DCU to rapidly dismantle new infrastructure as it emerged. This sustained intervention severed the actor&rsquo;s access to sensitive data and significantly hindered its ability to conduct reconnaissance, protecting organizations across the Middle East from state-sponsored interference.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/security-insider\/threat-landscape\/smoke-sandstorm\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Smoke Sandstorm\">Read more about how the DCU disrupted Smoke Sandstorm<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/bohrium\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against&#8239;Smoke Sandstorm\">Learn more about the legal action against&#8239;Smoke Sandstorm<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"zloader\" data-tags='[\"malware\",\"ransomware\",\"cybercrime-tools-and-services\"]' data-search=\"zloader malware ransomware cybercrime tools and services zloader malware ransomware cybercrime tools and services a global cybercrime group operating the zloader malware-as-a-service&#8239;(maas)&#8239;botnet leveraged advanced evasion techniques, including a domain generation algorithm (dga), to steal credentials, disable security tools, and deliver follow-on ransomware such as ryuk, which repeatedly targeted healthcare organizations. the threat actor hit businesses, hospitals, schools, and con\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">April 2022<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">ZLoader<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">A global cybercrime group operating the ZLoader Malware-as-a-Service&#8239;(MaaS)&#8239;botnet leveraged advanced evasion techniques, including a domain generation algorithm (DGA), to steal credentials, disable security tools, and deliver follow-on ransomware such as Ryuk, which repeatedly targeted healthcare organizations. The threat actor hit businesses, hospitals, schools, and consumers, enabling account takeovers, financial theft, and extortion&mdash;putting patient safety and critical services at risk. To disrupt it, the DCU obtained a US federal court order seizing 65 command-and-control and 319 additional DGA domains, redirecting them to Microsoft sinkholes and blocking future registrations. The action combined legal and technical measures with partners including ESET, Black Lotus Labs, Unit 42, FS-ISAC, Health-ISAC, Avast, and Microsoft security teams, plus referrals to law enforcement and ISP coordination&mdash;demonstrating an ecosystem-wide approach to disrupting organized cybercrime.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2022\/04\/13\/zloader-botnet-disrupted-malware-ukraine\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted ZLoader\">Read more about how the DCU disrupted ZLoader<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/zloader\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against ZLoader&#8239;\">Learn more about the legal action against ZLoader&#8239;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"nylon-typhoon\" data-tags='[\"nation-state\",\"ransomware\",\"cybercrime-tools-and-services\"]' data-search=\"nylon typhoon nation-state ransomware cybercrime tools and services nylon typhoon nation-state ransomware cybercrime tools and services nylong typhoon, also tracked as nickel, is a china-based threat actor that conducted sophisticated espionage against government agencies, diplomatic entities, and ngos across 29 countries. the group exploited unpatched vulnerabilities to deploy custom malware, allowing for long-term persistence and the exfiltration of sensitive data. microsoft identified these a\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">December 2021<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Nylon Typhoon<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Nylong Typhoon, also tracked as Nickel, is a China-based threat actor that conducted sophisticated espionage against government agencies, diplomatic entities, and NGOs across 29 countries. The group exploited unpatched vulnerabilities to deploy custom malware, allowing for long-term persistence and the exfiltration of sensitive data. Microsoft identified these activities as a strategic threat to international organizations, resulting in the DCU initiating a landmark legal action to disrupt the actor&rsquo;s global reach. By securing a court order, the DCU seized control of the group&rsquo;s malicious infrastructure, redirecting traffic from compromised sites to secure servers. A Court Monitor oversaw the case until June 2025, allowing the DCU to swiftly dismantle new infrastructure used by the actor. This proactive intervention effectively severed the actor&rsquo;s command-and-control capabilities, protecting high-value targets and slowing state-sponsored espionage.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2021\/12\/06\/cyberattacks-nickel-dcu-china\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Nylon Typhoon\">Read more about how the DCU disrupted Nylon Typhoon<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/security-insider\/threat-landscape\/nylon-typhoon\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about our Microsoft Threat Intelligence research into Nylon Typhoon\">Read more about our Microsoft Threat Intelligence research into Nylon Typhoon<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.com\/Nickel\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against&#8239;NYLOON TYPHOON\">Learn more about the legal action against&#8239;NYLOON TYPHOON<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"emotet\" data-tags='[\"malware\"]' data-search='emotet malware emotet malware emotet was first observed by microsoft in july 2014 as a globally distributed banking and financial trojan and malware-distribution botnet. the dcu identified emotet as a foundational threat to the global economy due to its ability to sell \"access\" to compromised corporate and government networks. the dcu played a key private-sector partner role in europol&rsquo;s coordinated disruption of emotet by providing critical threat intelligence and technical analysis that '>\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">March 2021<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Emotet<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Emotet was first observed by Microsoft in July 2014 as a globally distributed banking and financial trojan and malware-distribution botnet. The DCU identified Emotet as a foundational threat to the global economy due to its ability to sell &ldquo;access&rdquo; to compromised corporate and government networks. The DCU played a key private-sector partner role in Europol&rsquo;s coordinated disruption of Emotet by providing critical threat intelligence and technical analysis that enabled law enforcement to identify and seize the botnet&rsquo;s command-and-control infrastructure. While the operation was led by international law enforcement, the DCU&rsquo;s support helped make the coordinated takedown effective at scale and reduced Emotet&rsquo;s use as a primary gateway for ransomware and other cybercrime.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/world%e2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the Emotet disruption\">Learn more about the Emotet disruption<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"trickbot\" data-tags='[\"malware\",\"ransomware\",\"cybercrime-tools-and-services\"]' data-search=\"trickbot malware ransomware cybercrime tools and services trickbot malware ransomware cybercrime tools and services trickbot was a sophisticated, globally dispersed botnet that evolved from a financial trojan into a dominant ransomware distributor and a primary threat to election integrity. microsoft identified trickbot as a systemic risk due to its ability to disable security software and provide backdoors for attacks like ryuk. to dismantle this cybercrime engine, the dcu, working with public-\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">October 2020<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Trickbot<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Trickbot was a sophisticated, globally dispersed botnet that evolved from a financial trojan into a dominant ransomware distributor and a primary threat to election integrity. Microsoft identified Trickbot as a systemic risk due to its ability to disable security software and provide backdoors for attacks like Ryuk. To dismantle this cybercrime engine, the DCU, working with public- and private-sector partners such as FS-ISAC, ESET, NTT, Symantec, and law enforcement, coordinated a disruption, including securing a federal court order to disable the botnet&rsquo;s infrastructure. By also working with global telecommunications providers, the DCU severed the links between the operators and their network of millions of devices, including compromised routers. This strategic intervention prevented the potential deployment of ransomware against critical voting infrastructure and demonstrated the DCU&rsquo;s unique ability to protect democratic processes through large-scale technical and legal leadership.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2020\/10\/12\/trickbot-ransomware-cyberthreat-us-elections\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Trickbot\">Read more about how the DCU disrupted Trickbot<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2020\/10\/20\/trickbot-ransomware-disruption-update\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the Trickbot disruption\">Read more about the Trickbot disruption<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.com\/trickbot\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Trickbot\">Learn more about the legal action against Trickbot<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"trickbot\" data-tags='[\"fraud\"]' data-search=\"trickbot fraud covid-19 bonus phishing fraud covid-19 bonus was a business email compromise (bec) campaign that rapidly adapted to global events, using pandemic-themed lures to target victims worldwide. first identified by the dcu in december 2019, the campaign evolved to exploit covid-19-related financial anxieties, with phishing emails falsely promising a &ldquo;covid-19 bonus&rdquo; to induce engagement. instead of stealing credentials directly, the actors leveraged &ldquo;consent phishing,&amp;r\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">July 2020<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">COVID-19 Bonus Phishing<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">COVID-19 Bonus was a business email compromise (BEC) campaign that rapidly adapted to global events, using pandemic-themed lures to target victims worldwide. First identified by the DCU in December 2019, the campaign evolved to exploit COVID-19-related financial anxieties, with phishing emails falsely promising a &ldquo;COVID-19 Bonus&rdquo; to induce engagement. Instead of stealing credentials directly, the actors leveraged &ldquo;consent phishing,&rdquo; tricking users into granting a malicious web application access to their Microsoft 365 accounts&mdash;enabling unauthorized access to emails, contacts, and sensitive business data. Recognizing the scale and adaptability of the operation, DCU pursued a civil action in the US, obtaining a court order to seize key domains used in the attackers&rsquo; infrastructure. This action disabled the core delivery mechanism for the phishing campaign, preventing further compromise and disrupting follow-on BEC fraud schemes that relied on access to victim accounts.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2020\/07\/07\/digital-crimes-unit-covid-19-cybercrime\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted COVID-19-related cybercrime\">Read more about how the DCU disrupted COVID-19-related cybercrime<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.com\/COVID-19-Bonus-Phishing\/#\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against the COVID-19 Bonus Phishing\">Learn more about the legal action against the COVID-19 Bonus Phishing<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"necurs\" data-tags='[\"malware\",\"ransomware\",\"cybercrime-tools-and-services\"]' data-search=\"necurs malware ransomware cybercrime tools and services necurs malware ransomware cybercrime tools and services necurs was a prolific botnet that infected over nine million computers, serving as a primary global delivery engine for banking trojans and ransomware. the dcu identified necurs as a foundational threat to the digital ecosystem due to its massive spam output and ability to rent infected devices to other criminals. to neutralize this operation, the dcu orchestrated a coordinated strike \">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">March 2020<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Necurs<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-30wvzs9, #a0d2c7);color: var(--tag-id-fg-tag-30wvzs9, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-30wvzs9\">\n\tRansomware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Necurs was a prolific botnet that infected over nine million computers, serving as a primary global delivery engine for banking trojans and ransomware. The DCU identified Necurs as a foundational threat to the digital ecosystem due to its massive spam output and ability to rent infected devices to other criminals. To neutralize this operation, the DCU orchestrated a coordinated strike across 35 countries. By reverse-engineering the botnet&rsquo;s algorithm, the DCU predicted and blocked over six million future domains while securing a court order to seize its US infrastructure. This intervention effectively severed the botnet&rsquo;s command-and-control, protecting millions of users and demonstrating the DCU&rsquo;s expertise in dismantling the world&rsquo;s most resilient criminal networks.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2020\/03\/10\/necurs-botnet-cyber-crime-disrupt\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Necurs\">Read more about how the DCU disrupted Necurs<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.com\/necurs\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Necurs\">Learn more about the legal action against Necurs<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"emerald-sleet\" data-tags='[\"nation-state\"]' data-search=\"emerald sleet nation-state emerald sleet nation-state emerald sleet, also tracked as thallium, is a north korea-based state actor that targeted government officials, human rights organizations, and nuclear-proliferation experts to conduct long-term espionage. the dcu identified the group&rsquo;s use of fraudulent domains mimicking microsoft services to harvest credentials and maintain persistent access to sensitive networks. to disrupt this threat, the dcu initiated a strategic civil action in t\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">December 2019<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Emerald Sleet<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Emerald Sleet, also tracked as Thallium, is a North Korea-based state actor that targeted government officials, human rights organizations, and nuclear-proliferation experts to conduct long-term espionage. The DCU identified the group&rsquo;s use of fraudulent domains mimicking Microsoft services to harvest credentials and maintain persistent access to sensitive networks. To disrupt this threat, the DCU initiated a strategic civil action in the US District Court for the Eastern District of Virginia, securing a court order to seize 50 malicious domains used for command-and-control. This disruption, supported by a persistent Court Monitor, allows the DCU to swiftly neutralize new infrastructure as it emerges. By severing these communication lines, the DCU protects high-value targets and significantly hinders the actor&rsquo;s ability to conduct unauthorized surveillance and data exfiltration.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2019\/12\/30\/microsoft-court-action-against-nation-state-cybercrime\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Emerald Sleet\">Read more about how the DCU disrupted Emerald Sleet<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/thallium\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Emerald Sleet\">Learn more about the legal action against Emerald Sleet<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"mint-sandstorm\" data-tags='[\"nation-state\"]' data-search=\"mint sandstorm nation-state mint sandstorm nation-state mint sandstorm, also tracked as phosphorus, is an iran-based threat actor that targeted prominent individuals in business and government, including activists and journalists, to conduct long-term espionage. microsoft threat intelligence identified the group&rsquo;s use of highly tailored spear-phishing and custom malware to compromise sensitive accounts and maintain persistent access. to neutralize this threat, the dcu initiated a strategic\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">March 2019<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Mint Sandstorm<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Mint Sandstorm, also tracked as Phosphorus, is an Iran-based threat actor that targeted prominent individuals in business and government, including activists and journalists, to conduct long-term espionage. Microsoft Threat Intelligence identified the group&rsquo;s use of highly tailored spear-phishing and custom malware to compromise sensitive accounts and maintain persistent access. To neutralize this threat, the DCU initiated a strategic legal action in the US District Court for the District of Columbia, securing a court order to seize the malicious domains used for credential harvesting and command-and-control. This disruption, supported by an ongoing Court Monitor, enables the DCU to rapidly dismantle new infrastructure as it is identified. By severing these operational links, the DCU protects high-value targets and significantly raises the cost for the actor to maintain its surveillance capabilities.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2019\/10\/04\/recent-cyberattacks-require-us-all-to-be-vigilant\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the Mint Sandstorm disruption\">Read more about the Mint Sandstorm disruption<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2019\/03\/27\/new-steps-to-protect-customers-from-hacking\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted MINT SANDSTORM\">Read more about how the DCU disrupted MINT SANDSTORM<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/security-insider\/threat-landscape\/mint-sandstorm\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about Microsoft Threat Intelligence research into Mint Sandstorm\">Read more about Microsoft Threat Intelligence research into Mint Sandstorm<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/noticeofpleadings.com\/phosphorus\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Mint Sandstorm\">Learn more about the legal action against Mint Sandstorm<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"gamarue\" data-tags='[\"malware\",\"cybercrime-tools-and-services\"]' data-search='gamarue malware cybercrime tools and services gamarue malware cybercrime tools and services gamarue, also tracked as andromeda, was a prolific botnet and \"crime kit\" that facilitated the distribution of over 80 malware families, including ransomware and banking trojans. microsoft threat intelligence identified gamarue as a major threat to global security due to its ability to disable system defenses and evade automated analysis. to dismantle this infrastructure, the dcu spearheaded a global inve'>\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">November 2017<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Gamarue<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Gamarue, also tracked as Andromeda, was a prolific botnet and &ldquo;crime kit&rdquo; that facilitated the distribution of over 80 malware families, including ransomware and banking trojans. Microsoft Threat Intelligence identified Gamarue as a major threat to global security due to its ability to disable system defenses and evade automated analysis. To dismantle this infrastructure, the DCU spearheaded a global investigation in coordination with Europol, the FBI, Germany&rsquo;s Federal Office for Information Security (BSI), and ESET. Following a landmark legal filing, the DCU secured a court order to seize and sinkhole 1,500 malicious domains used for command-and-control. This massive disruption severed the link between millions of infected devices and their operators, effectively neutralizing a foundational engine of cybercrime. Through this leadership, the DCU protected millions of users and crippled a key monetization model for global threat actors.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/andromeda-botnet-dismantled-in-international-cyber-operation\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the Gamarue disruption\">Learn more about the Gamarue disruption<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.net\/gamarue\/index.html\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Gamarue\">Learn more about the legal action against Gamarue<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"avalanche\" data-tags='[\"fraud\",\"malware\"]' data-search=\"avalanche fraud malware avalanche fraud malware avalanche was a criminal syndicate and infrastructure used for large-scale phishing, online banking fraud, ransomware, and money mule operations. the avalanche network&mdash;composed of owned, rented, and compromised systems&mdash;enabled cybercriminals to host and rapidly distribute multiple malware families, targeting victims worldwide, including more than 40 major financial institutions. victims faced the theft of sensitive personal and financia\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">November 2017<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Avalanche<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Avalanche was a criminal syndicate and infrastructure used for large-scale phishing, online banking fraud, ransomware, and money mule operations. The Avalanche network&mdash;composed of owned, rented, and compromised systems&mdash;enabled cybercriminals to host and rapidly distribute multiple malware families, targeting victims worldwide, including more than 40 major financial institutions. Victims faced the theft of sensitive personal and financial data such as account credentials and banking information, while compromised machines were further abused to propagate malware, launch denial-of-service attacks, and support downstream criminal activity. Through coordinated disruption efforts led by the DCU, in close partnership with Fraunhofer, the Shadowserver Foundation, the FBI, Germany&rsquo;s Federal Office for Information Security, and Europol&rsquo;s European Cybercrime Centre, this criminal infrastructure was dismantled&mdash;cutting off a key enabler of fraud, malware distribution, and money laundering.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/%e2%80%98avalanche%e2%80%99-network-dismantled-in-international-cyber-operation\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the Avalanche disruption\">Learn more about the Avalanche disruption<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"brass-typhoon\" data-tags='[\"nation-state\"]' data-search=\"brass typhoon nation-state brass typhoonka barium nation-state brass typhoon, also tracked as barium, is a china-based nation&#8209;state threat actor that targeted the global gaming and internet-content industries to exfiltrate high-value intellectual property and sensitive data. microsoft threat intelligence identified the group&rsquo;s use of a specialized malware toolkit designed for stealthy credential theft and persistent network exploitation. to neutralize this threat, the dcu initiated a\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">October 2017<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Brass Typhoonka BARIUM<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Brass Typhoon, also tracked as Barium, is a China-based nation&#8209;state threat actor that targeted the global gaming and internet-content industries to exfiltrate high-value intellectual property and sensitive data. Microsoft Threat Intelligence identified the group&rsquo;s use of a specialized malware toolkit designed for stealthy credential theft and persistent network exploitation. To neutralize this threat, the DCU initiated a strategic legal action in the US District Court for the District of Columbia, securing a court order to seize the malicious domains used for command-and-control. A Court Monitor oversaw the case until November 2018, allowing the DCU to swiftly dismantle new infrastructure used by the actor. This proactive intervention protected countless organizations from unauthorized surveillance and sophisticated state-sponsored espionage.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.net\/barium\/index.html\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against&#8239;Brass Typhoon\">Learn more about the legal action against&#8239;Brass Typhoon<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"forest-blizzard\" data-tags='[\"nation-state\"]' data-search=\"forest blizzard nation-state forest blizzard nation-state forest blizzard, also tracked as strontium, is a russian state-affiliated actor that leveraged zero-day exploits and spear-phishing to target government agencies, think tanks, and sporting organizations worldwide. microsoft threat intelligence identified the group as a persistent threat to democratic institutions and international stability, particularly during its campaigns to disrupt the 2020 tokyo olympics and target ukrainian infrastr\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">August 2016<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Forest Blizzard<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-5utjqi0, #ffe399);color: var(--tag-id-fg-tag-5utjqi0, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-5utjqi0\">\n\tnation-state<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Forest Blizzard, also tracked as Strontium, is a Russian state-affiliated actor that leveraged zero-day exploits and spear-phishing to target government agencies, think tanks, and sporting organizations worldwide. Microsoft Threat Intelligence identified the group as a persistent threat to democratic institutions and international stability, particularly during its campaigns to disrupt the 2020 Tokyo Olympics and target Ukrainian infrastructure. To neutralize these operations, the DCU spearheaded multiple strategic legal actions, securing court orders to seize the actor&rsquo;s command-and-control domains. Supported by a long-term Court Monitor until March 2025, the DCU was able to rapidly dismantle new malicious infrastructure as it emerged. This sustained intervention severed the actor&rsquo;s access to sensitive networks, protected high-value targets from state-sponsored espionage, and demonstrated the DCU&rsquo;s global leadership in defending the digital ecosystem.<\/p>\n\n\n<div class=\"wp-block-buttons alignwide is-layout-flex wp-container-core-buttons-is-layout-45b20515 wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2018\/08\/20\/we-are-taking-new-steps-against-broadening-threats-to-democracy\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU protected US elections from Forest Blizzard\">Read more about how the DCU protected US elections from Forest Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-container-core-buttons-is-layout-0a806215 wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2019\/10\/28\/cyberattacks-sporting-anti-doping\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU protected sporting organizations from Forest Blizzard\">Read more about how the DCU protected sporting organizations from Forest Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2022\/04\/07\/cyberattacks-ukraine-strontium-russia\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU protected Ukrainian institutions from Forest Blizzard\">Read more about how the DCU protected Ukrainian institutions from Forest Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/security-insider\/threat-landscape\/forest-blizzard\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about Microsoft Threat Intelligence research into Forest Blizzard\">Read more about Microsoft Threat Intelligence research into Forest Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.noticeofpleadings.com\/strontium\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about legal action against Forest Blizzard\">Learn more about legal action against Forest Blizzard<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"dorkbot\" data-tags='[\"malware\"]' data-search=\"dorkbot malware dorkbot malware dorkbot was a rapidly evolving &ldquo;botnet-in-a-box&rdquo; malware operation spread through removable media and messaging services, enabling cybercriminals to steal personal and financial information and deliver malware at scale. by 2015, microsoft had identified ~100,000 new infections per month, with millions of devices globally compromised, creating significant risk to consumers and enterprises and generating billions of daily communications between infected \">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">December 2015<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Dorkbot<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Dorkbot was a rapidly evolving &ldquo;botnet-in-a-box&rdquo; malware operation spread through removable media and messaging services, enabling cybercriminals to steal personal and financial information and deliver malware at scale. By 2015, Microsoft had identified ~100,000 new infections per month, with millions of devices globally compromised, creating significant risk to consumers and enterprises and generating billions of daily communications between infected machines and criminal infrastructure. In response, the DCU, working with global partners including the FBI, Europol, INTERPOL, national CERTs, and ISPs, provided intelligence that enabled the physical seizure of command-and-control servers and redirected malicious traffic to Microsoft-managed sinkholes, where advanced analytics and cloud-scale AI-driven data processing delivered near-real-time insight, supported victim notification and remediation, and fed threat intelligence back into Microsoft&rsquo;s platforms to help prevent reinfection.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2015\/12\/17\/cloud-power-disrupts-global-malware\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted Dorkbot\">Read more about how the DCU disrupted Dorkbot<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/botnetlegalnotice.com\/dorkbot\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against Dorkbot\">Learn more about the legal action against Dorkbot<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"ramnit\" data-tags='[\"malware\",\"fraud\"]' data-search=\"ramnit malware fraud ramnit malware fraud ramnit&nbsp;was a stealthy botnet designed to harvest banking credentials, passwords, and personal files, giving cybercriminals remote control over millions of devices while evading traditional defenses via rapidly shifting command-and-control (c2) infrastructure. at its peak,&nbsp;ramnit&nbsp;infected approximately 3.2 million computers worldwide, contributing to broader economic harm from botnets that accounted for 34% of&nbsp;observed&nbsp;cyberattack\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">February 2015<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Ramnit<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Ramnit&nbsp;was a stealthy botnet designed to harvest banking credentials, passwords, and personal files, giving cybercriminals remote control over millions of devices while evading traditional defenses via rapidly shifting command-and-control (C2) infrastructure. At its peak,&nbsp;Ramnit&nbsp;infected approximately 3.2 million computers worldwide, contributing to broader economic harm from botnets that accounted for 34% of&nbsp;observed&nbsp;cyberattacks in 2014 and enabled large-scale fraud and identity theft affecting consumers, enterprises, and financial institutions. In a coordinated disruption led by Europol&rsquo;s European Cybercrime Centre, the DCU worked with Symantec,&nbsp;AnubisNetworks, national law enforcement agencies across Europe, and ISPs to shut down C2 servers and redirect 300 malicious domains, using cloud-scale analytics and near-real-time data processing to analyze hundreds of thousands of daily botnet communications, support victim remediation, and materially degrade&nbsp;Ramnit&rsquo;s&nbsp;ability to operate.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/eupolicy\/2015\/10\/22\/breaking-up-a-botnet-how-ramnit-was-foiled\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about how the DCU disrupted&nbsp;Ramnit&nbsp;\">Read more about how the DCU disrupted&nbsp;Ramnit&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/botnetlegalnotice.com\/ramnit\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the legal action against&nbsp;Ramnit&#8239;&nbsp;\">Learn more about the legal action against&nbsp;Ramnit&#8239;&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"simda\" data-tags='[\"malware\",\"fraud\"]' data-search=\"simda malware fraud simda malware fraud simda&nbsp;was a&nbsp;sophisticated botnet used by cybercriminals to gain remote access to infected computers, steal personal and banking credentials, and distribute&nbsp;malware through a&nbsp;pay-per-install&nbsp;criminal model that regenerated variants to evade detection. the operation infected&nbsp;over&nbsp;770,000 computers&nbsp;in&nbsp;over 190 countries, with 90,000 new infections detected in the us in the first two months of 2015, exposing individ\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">April 2015<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Simda<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Simda&nbsp;was a&nbsp;sophisticated botnet used by cybercriminals to gain remote access to infected computers, steal personal and banking credentials, and distribute&nbsp;malware through a&nbsp;pay-per-install&nbsp;criminal model that regenerated variants to evade detection. The operation infected&nbsp;over&nbsp;770,000 computers&nbsp;in&nbsp;over 190 countries, with 90,000 new infections detected in the US in the first two months of 2015, exposing individuals, financial institutions, and internet&nbsp;networks&nbsp;to fraud, data theft, and traffic interception. In a coordinated global disruption, INTERPOL, the FBI, and&nbsp;other&nbsp;law enforcement partners worked with&nbsp;the DCU, Kaspersky Lab, Trend Micro, and Japan&rsquo;s Cyber Defense Institute to seize and dismantle&nbsp;servers in multiple countries, using&nbsp;large-scale&nbsp;data analytics and&nbsp;heat-mapping&nbsp;techniques to identify infrastructure and victim impact, while redirecting traffic, supporting remediation through free cleaning tools, and significantly degrading&nbsp;Simda&rsquo;s&nbsp;ability to operate.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.interpol.int\/News-and-Events\/News\/2015\/INTERPOL-coordinates-global-operation-to-take-down-Simda-botnet\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about the&nbsp;Simda&nbsp;disruption&nbsp;\">Learn more about the&nbsp;Simda&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"caphaw\" data-tags='[\"malware\",\"fraud\"]' data-search=\"caphaw malware fraud caphaw malware fraud caphaw&nbsp;was a financially motivated banking botnet designed to steal online banking credentials and enable fraudulent transactions by targeting banks and their customers, particularly across europe. the malware spread at scale through social and communication platforms such as facebook, youtube, and skype, as well as via removable drives and&nbsp;drive-by&nbsp;downloads, allowing cybercriminals to rapidly compromise consumer and enterprise devices an\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">July 2014<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Caphaw<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Caphaw&nbsp;was a financially motivated banking botnet designed to steal online banking credentials and enable fraudulent transactions by targeting banks and their customers, particularly across Europe. The malware spread at scale through social and communication platforms such as Facebook, YouTube, and Skype, as well as via removable drives and&nbsp;drive-by&nbsp;downloads, allowing cybercriminals to rapidly compromise consumer and enterprise devices and expose victims to account takeover, identity theft, and significant financial losses. To disrupt the threat,&nbsp;the DCU&nbsp;worked closely with UK law enforcement and financial industry partners, leveraging&nbsp;intelligence-sharing&nbsp;collaborations such as&nbsp;the&nbsp;FS-ISAC to provide near-real-time&nbsp;visibility into malware infections affecting tens of millions of unique IP addresses and using&nbsp;cloud-based&nbsp;analytics on Microsoft Azure to support infrastructure takedowns, accelerate remediation, and strengthen protection for financial institutions and customers.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2014\/09\/29\/microsoft-partners-financial-services-industry-fight-cybercrime\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Caphaw&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Caphaw&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"gameover-zeus\" data-tags='[\"malware\",\"fraud\"]' data-search=\"gameover zeus malware fraud gameover zeus malware fraud gameover&nbsp;zeus was&nbsp;a highly&nbsp;destructive financial malware operation,&nbsp;acting&nbsp;as a&nbsp;peer-to-peer&nbsp;botnet designed to steal banking credentials and deliver ransomware&nbsp;that&nbsp;eliminated&nbsp;centralized&nbsp;command-and-control&nbsp;servers. the malware infected more than one million computers worldwide and was linked to over $100 million in financial losses,&nbsp;impacting&nbsp;individuals,&nbsp;business\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">June 2014<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">GameOver Zeus<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">GameOver&nbsp;Zeus was&nbsp;a highly&nbsp;destructive financial malware operation,&nbsp;acting&nbsp;as a&nbsp;peer-to-peer&nbsp;botnet designed to steal banking credentials and deliver ransomware&nbsp;that&nbsp;eliminated&nbsp;centralized&nbsp;command-and-control&nbsp;servers. The malware infected more than one million computers worldwide and was linked to over $100 million in financial losses,&nbsp;impacting&nbsp;individuals,&nbsp;businesses, financial institutions, and critical services as stolen credentials were monetized and ransomware attacks escalated. In 2014, a coordinated disruption known as Operation Tovar brought together&nbsp;the DCU, the FBI, Europol, Interpol, national law enforcement agencies, and&nbsp;private-sector&nbsp;partners,&nbsp;including industry security firms and ISPs, using&nbsp;large-scale&nbsp;data analytics and&nbsp;sinkholing&nbsp;techniques to seize domain infrastructure, sever botnet communications, redirect infected machines, and provide remediation support&mdash;significantly degrading&nbsp;GameOver&nbsp;Zeus&rsquo;s ability to operate, propagate, and generate criminal revenue.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2014\/06\/02\/microsoft-helps-fbi-in-gameover-zeus-botnet-cleanup\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more on how&nbsp;the&nbsp;DCU disrupted&nbsp;GameOver&nbsp;Zeus&nbsp;\">Read more on how&nbsp;the&nbsp;DCU disrupted&nbsp;GameOver&nbsp;Zeus&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"bladabindi-jenxcus\" data-tags='[\"malware\",\"fraud\",\"cybercrime-tools-and-services\"]' data-search=\"bladabindi &amp; jenxcus malware fraud cybercrime tools and services bladabindi &amp; jenxcus malware fraud cybercrime tools and services bladabindi&nbsp;(njrat) and&nbsp;jenxcus&nbsp;(njw0rm) were highly prevalent families of malware that enabled remote access, credential theft, surveillance, and&nbsp;other malware distribution, allowing cybercriminals to&nbsp;maintain&nbsp;control over infected machines.&nbsp;microsoft&nbsp;observed&nbsp;more than 7.4 million detections in a single year, with infe\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">June 2014<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Bladabindi &amp; Jenxcus<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Bladabindi&nbsp;(NJRat) and&nbsp;Jenxcus&nbsp;(NJw0rm) were highly prevalent families of malware that enabled remote access, credential theft, surveillance, and&nbsp;other malware distribution, allowing cybercriminals to&nbsp;maintain&nbsp;control over infected machines.&nbsp;Microsoft&nbsp;observed&nbsp;more than 7.4 million detections in a single year, with infections affecting millions of customers worldwide, exposing&nbsp;victims&nbsp;to data theft, fraud, and disruption. To disrupt the threat,&nbsp;the DCU&nbsp;filed&nbsp;a civil action in US&nbsp;federal court, securing authority over 23 abused dynamic DNS domains used to control the malware, and&mdash;working with ISPs, global CERTs,&nbsp;A10 Networks, and industry partners&mdash;redirected malicious traffic to Microsoft-managed sinkholes. Using cloud-scale analytics on Microsoft Azure and advanced malware analysis, Microsoft&nbsp;identified&nbsp;infected systems, shared intelligence through its Cyber Threat Intelligence Program, enabled remediation, and significantly degraded the criminals&rsquo; ability to&nbsp;execute&nbsp;their operations.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2014\/06\/30\/microsoft-takes-on-global-cybercrime-epidemic-in-tenth-malware-disruption\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how DCU disrupted&nbsp;Bladabindi&nbsp;&amp;amp;&nbsp;Jenxcus&nbsp;&nbsp;\">Read more&nbsp;about&nbsp;how DCU disrupted&nbsp;Bladabindi&nbsp;&amp;&nbsp;Jenxcus&nbsp;&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"zeroaccess\" data-tags='[\"malware\",\"fraud\"]' data-search=\"zeroaccess malware fraud zeroaccess malware fraud zeroaccess,&nbsp;also&nbsp;tracked&nbsp;as&nbsp;sirefef,&nbsp;was a&nbsp;peer-to-peer&nbsp;botnet used&nbsp;for&nbsp;large-scale&nbsp;fraud, including click fraud and&nbsp;malware&nbsp;distribution.&nbsp;the malware compromised millions of computers globally, imposing&nbsp;significant remediation costs on consumers, enterprises, and the&nbsp;broader&nbsp;digital ecosystem as infected devices were exploited for criminal gain. in a coordinated disr\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">December 2013<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">ZeroAccess<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">ZeroAccess,&nbsp;also&nbsp;tracked&nbsp;as&nbsp;Sirefef,&nbsp;was a&nbsp;peer-to-peer&nbsp;botnet used&nbsp;for&nbsp;large-scale&nbsp;fraud, including click fraud and&nbsp;malware&nbsp;distribution.&nbsp;The malware compromised millions of computers globally, imposing&nbsp;significant remediation costs on consumers, enterprises, and the&nbsp;broader&nbsp;digital ecosystem as infected devices were exploited for criminal gain. In a coordinated disruption,&nbsp;the DCU&nbsp;filed a civil action in US federal court and worked closely with Europol&rsquo;s European Cybercrime Centre (EC3) and national law enforcement agencies,&nbsp;including Germany&rsquo;s BKA and cybercrime units across Europe,&nbsp;to identify and cut off fraudulent infrastructure, monitor criminal attempts to reconstitute the botnet, and rapidly trace newly deployed IP addresses&mdash;ultimately prompting the operators to abandon the botnet entirely, underscoring the effectiveness of sustained&nbsp;public-private&nbsp;partnerships in degrading and dismantling complex cybercrime operations.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2013\/12\/05\/microsoft-europol-fbi-and-industry-partners-disrupt-notorious-zeroaccess-botnet-that-hijacks-search-results\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;ZeroAccess&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;ZeroAccess&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2013\/12\/19\/zeroaccess-criminals-wave-white-flag-the-impact-of-partnerships-on-cybercrime\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the&nbsp;ZeroAccess&nbsp;disruption&nbsp;\">Read more about the&nbsp;ZeroAccess&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"citadel\" data-tags='[\"malware\",\"fraud\"]' data-search=\"citadel malware fraud citadel malware fraud citadel was a sophisticated&nbsp;zeus-derived&nbsp;banking trojan used to steal online banking credentials and identities at scale, including by logging keystrokes and conducting&nbsp;man-in-the-middle&nbsp;attacks&mdash;injecting&nbsp;pop-ups&nbsp;and monitoring web traffic to trick victims into entering sensitive financial information on legitimate sites.&nbsp;it compromised ~5 million pcs and was tied to more than $500m in theft,&nbsp;impacting&amp;nbsp\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">June 2013<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Citadel<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Citadel was a sophisticated&nbsp;Zeus-derived&nbsp;banking Trojan used to steal online banking credentials and identities at scale, including by logging keystrokes and conducting&nbsp;man-in-the-middle&nbsp;attacks&mdash;injecting&nbsp;pop-ups&nbsp;and monitoring web traffic to trick victims into entering sensitive financial information on legitimate sites.&nbsp;It compromised ~5 million PCs and was tied to more than $500M in theft,&nbsp;impacting&nbsp;consumers, businesses, and dozens of major financial institutions.&nbsp;To disrupt the operation,&nbsp;the&nbsp;DCU&mdash;working with the FBI and financial services and technology partners&mdash;used a US civil court order to seize and disable key&nbsp;command-and-control&nbsp;infrastructure supporting ~1,400 botnets, raising the cost and risk for the criminals and enabling broader remediation and&nbsp;follow-on&nbsp;investigations.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2013\/06\/21\/initial-revelations-and-results-of-the-citadel-botnet-operation\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the&nbsp;Citadel&nbsp;disruption&nbsp;\">Read more about the&nbsp;Citadel&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2013\/06\/05\/microsoft-works-with-financial-services-industry-leaders-law-enforcement-and-others-to-disrupt-massive-financial-cybercrime-ring\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Citadel&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Citadel&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2014\/09\/29\/microsoft-partners-financial-services-industry-fight-cybercrime\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about Microsoft&rsquo;s partnership with FS-ISAC&nbsp;\">Read more&nbsp;about Microsoft&rsquo;s partnership with FS-ISAC&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"bamital\" data-tags='[\"malware\",\"fraud\"]' data-search=\"bamital malware fraud bamital malware fraud bamital&nbsp;was a&nbsp;large-scale&nbsp;botnet designed to hijack internet search results, redirecting users to malicious&nbsp;sites for&nbsp;malware delivery, spyware installation, and click fraud, undermining trust in search and advertising ecosystems.&nbsp;the malware infected more than 8 million computers worldwide,&nbsp;exposing victims to identity theft&nbsp;and financial harm, while defrauding the online advertising industry. to disrupt the thr\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">June 2013<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Bamital<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Bamital&nbsp;was a&nbsp;large-scale&nbsp;botnet designed to hijack internet search results, redirecting users to malicious&nbsp;sites for&nbsp;malware delivery, spyware installation, and click fraud, undermining trust in search and advertising ecosystems.&nbsp;The malware infected more than 8 million computers worldwide,&nbsp;exposing victims to identity theft&nbsp;and financial harm, while defrauding the online advertising industry. To disrupt the threat,&nbsp;the DCU&nbsp;partnered with Symantec, filed a civil lawsuit, and&mdash;under court authorization and with support from the US&nbsp;Marshals Service&mdash;seized botnet infrastructure across multiple&nbsp;US hosting&nbsp;facilities, severing&nbsp;command-and-control&nbsp;links. As part of the operation, Microsoft and Symantec redirected victim traffic to a remediation site, shared intelligence with ISPs and CERTs, and used the takedown data to strengthen broader protections&mdash;demonstrating&nbsp;how coordinated&nbsp;public-private&nbsp;action can dismantle criminal infrastructure and protect millions of users.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2013\/02\/06\/microsoft-and-symantec-take-down-bamital-botnet-that-hijacks-online-searches\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Bamital&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Bamital&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2013\/02\/22\/bamital-botnet-takedown-is-successful-cleanup-underway\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the&nbsp;Bamital&nbsp;disruption&nbsp;\">Read more about the&nbsp;Bamital&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"nitol\" data-tags='[\"malware\",\"cybercrime-tools-and-services\"]' data-search=\"nitol malware cybercrime tools and services nitol malware cybercrime tools and services nitol&nbsp;was&nbsp;a&nbsp;botnet discovered through microsoft research&nbsp;on&nbsp;insecure technology supply chains,&nbsp;using over&nbsp;70,000 subdomains hosted on the 3322.org service to distribute&nbsp;more than&nbsp;500 different malware strains. the malware infected millions of computers globally,&nbsp;often&nbsp;through compromised software&nbsp;before reaching consumers, exposing&nbsp;victims&nbsp;\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">September 2012<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Nitol<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Nitol&nbsp;was&nbsp;a&nbsp;botnet discovered through Microsoft research&nbsp;on&nbsp;insecure technology supply chains,&nbsp;using over&nbsp;70,000 subdomains hosted on the 3322.org service to distribute&nbsp;more than&nbsp;500 different malware strains. The malware infected millions of computers globally,&nbsp;often&nbsp;through compromised software&nbsp;before reaching consumers, exposing&nbsp;victims&nbsp;to credential theft&nbsp;and&nbsp;fraud&nbsp;while undermining trust&nbsp;in PCs. To disrupt the threat,&nbsp;the DCU&nbsp;filed&nbsp;a civil action that led to a landmark settlement, working with the 3322.org&nbsp;operator&nbsp;and the China Computer Emergency Response Team (CN-CERT) to block subdomains, redirect traffic to managed sinkholes, and support victims; in&nbsp;just&nbsp;16&nbsp;days, the action blocked over 609 million connections from more than 7.6 million unique IP addresses, while intelligence was shared with CERTs in over 40 countries, ISPs, and partners such as&nbsp;Shadowserver, demonstrating the power of&nbsp;data-driven&nbsp;public-private&nbsp;coordination&nbsp;to dismantle&nbsp;cybercrime infrastructure.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2012\/09\/13\/microsoft-disrupts-the-emerging-nitol-botnet-being-spread-through-an-unsecure-supply-chain\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Nitol&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Nitol&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2012\/10\/02\/microsoft-reaches-settlement-with-defendants-in-nitol-case\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the&nbsp;Nitol&nbsp;disruption&nbsp;\">Read more about the&nbsp;Nitol&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"zeus\" data-tags='[\"malware\",\"fraud\"]' data-search=\"zeus malware fraud zeus aka zbot malware fraud zeus, also tracked as&nbsp;zbot,&nbsp;was one of the most prolific financial malware families,&nbsp;operating&nbsp;as a&nbsp;credential-stealing&nbsp;trojan that infected computers through phishing and&nbsp;drive-by&nbsp;downloads to capture keystrokes, intercept web sessions, and steal online banking credentials. the malware compromised millions of consumer and enterprise devices globally and&nbsp;was responsible for&nbsp;hundreds of millions of do\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">March 2012<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">ZEUS aka ZBOT<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Zeus, also tracked as&nbsp;Zbot,&nbsp;was one of the most prolific financial malware families,&nbsp;operating&nbsp;as a&nbsp;credential-stealing&nbsp;Trojan that infected computers through phishing and&nbsp;drive-by&nbsp;downloads to capture keystrokes, intercept web sessions, and steal online banking credentials. The malware compromised millions of consumer and enterprise devices globally and&nbsp;was responsible for&nbsp;hundreds of millions of dollars in financial losses,&nbsp;impacting&nbsp;individuals, banks, small businesses, and public institutions by enabling fraud, identity theft, and downstream criminal activity. To disrupt the threat,&nbsp;the DCU&nbsp;worked with law enforcement, financial institutions, FS-ISAC, ISPs, and global CERTs to pursue civil legal action, seize and disable Zeus&nbsp;infrastructure, redirect malicious traffic, and share actionable threat intelligence&mdash;supporting victim notification and&nbsp;support&nbsp;while significantly raising the cost&nbsp;of operating the Zeus ecosystem through coordinated&nbsp;public-private&nbsp;collaboration.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2012\/03\/25\/microsoft-and-financial-services-industry-leaders-target-cybercriminal-operations-from-zeus-botnets\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Zeus&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Zeus&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/www.zeuslegalnotice.com\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about&nbsp;the&nbsp;legal action against&nbsp;Zeus&nbsp;\">Learn more about&nbsp;the&nbsp;legal action against&nbsp;Zeus&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"kelihos\" data-tags='[\"malware\",\"cybercrime-tools-and-services\"]' data-search=\"kelihos malware cybercrime tools and services kelihos malware cybercrime tools and services kelihos&nbsp;was a&nbsp;spam-focused&nbsp;botnet&nbsp;that&nbsp;distributed&nbsp;malicious email, stole&nbsp;credentials,&nbsp;and&nbsp;spread&nbsp;malware&nbsp;via&nbsp;fast-flux&nbsp;infrastructure designed to evade takedowns. at its peak,&nbsp;kelihos&nbsp;infected hundreds of thousands of computers worldwide,&nbsp;enabling fraud, phishing, and malware while imposing remediation costs and degrading tru\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">September 2011<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Kelihos<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-k0jvx7t, #8dc8e8);color: var(--tag-id-fg-tag-k0jvx7t, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-k0jvx7t\">\n\tCybercrime tools and services<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Kelihos&nbsp;was a&nbsp;spam-focused&nbsp;botnet&nbsp;that&nbsp;distributed&nbsp;malicious email, stole&nbsp;credentials,&nbsp;and&nbsp;spread&nbsp;malware&nbsp;via&nbsp;fast-flux&nbsp;infrastructure designed to evade takedowns. At its peak,&nbsp;Kelihos&nbsp;infected hundreds of thousands of computers worldwide,&nbsp;enabling fraud, phishing, and malware while imposing remediation costs and degrading trust in email services. In response,&nbsp;the DCU&nbsp;pursued a series of coordinated civil legal actions, securing court orders to seize and sinkhole&nbsp;Kelihos&nbsp;domains, name and pursue operators and enablers, and later reach a settlement with infrastructure providers whose services were abused by the botnet. Working alongside law enforcement, ISPs, global CERTs, and industry partners, Microsoft repeatedly weakened&nbsp;Kelihos&rsquo;s&nbsp;infrastructure,&nbsp;supported cleanup and victim notification,&nbsp;and&nbsp;increased the operational cost and legal risk for the criminals&mdash;demonstrating&nbsp;how sustained,&nbsp;multi-phase&nbsp;public-private&nbsp;disruption can materially degrade even highly adaptive malware campaigns.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2012\/02\/03\/update-on-kelihos-botnet-and-new-related-malware\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;the final update on the&nbsp;Kelihos&nbsp;disruption&nbsp;\">Read&nbsp;the final update on the&nbsp;Kelihos&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2012\/01\/23\/microsoft-names-new-defendant-in-kelihos-case\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;the second update on the&nbsp;Kelihos&nbsp;disruption&nbsp;\">Read&nbsp;the second update on the&nbsp;Kelihos&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2011\/10\/26\/microsoft-reaches-settlement-with-piatti-dotfree-group-in-kelihos-case\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;the first update on the&nbsp;Kelihos&nbsp;disruption&nbsp;\">Read&nbsp;the first update on the&nbsp;Kelihos&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2011\/09\/27\/microsoft-neutralizes-kelihos-botnet-names-defendant-in-case\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how DCU disrupted&nbsp;Kelihos&nbsp;\">Read more&nbsp;about&nbsp;how DCU disrupted&nbsp;Kelihos&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"rustock\" data-tags='[\"malware\",\"fraud\"]' data-search=\"rustock malware fraud rustock malware fraud rustock&nbsp;was&nbsp;a&nbsp;spam-sending&nbsp;botnet, using stealthy rootkit techniques to infect computers and covertly distribute unsolicited email advertising counterfeit goods,&nbsp;scams, and malware. at its peak,&nbsp;rustock&nbsp;was responsible for over&nbsp;30 billion spam emails per day, accounting for up to 30&ndash;40% of global spam volume, with dcu researchers observing that a single infected machine could send 7,500 spam emails in just \">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">March 2011<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Rustock<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n\n\n<span style=\"background-color: var(--tag-id-bg-tag-duhcisk, #b9dcd2);color: var(--tag-id-fg-tag-duhcisk, #000)\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-duhcisk\">\n\tFraud<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Rustock&nbsp;was&nbsp;a&nbsp;spam-sending&nbsp;botnet, using stealthy rootkit techniques to infect computers and covertly distribute unsolicited email advertising counterfeit goods,&nbsp;scams, and malware. At its peak,&nbsp;Rustock&nbsp;was responsible for over&nbsp;30 billion spam emails per day, accounting for up to 30&ndash;40% of global spam volume, with DCU researchers observing that a single infected machine could send 7,500 spam emails in just 45 minutes&mdash;over 240,000 per day, imposing massive costs on consumers, enterprises, and internet&nbsp;networks. In 2011,&nbsp;the DCU&nbsp;led a landmark disruption alongside the US&nbsp;Department of Justice, FBI, and US&nbsp;Marshals Service, using civil court orders to seize&nbsp;servers across multiple hosting facilities, cut off botnet communications, preserve evidence, and later refer the case for criminal investigation; the effort ultimately forced the botnet offline, demonstrating the power of sustained legal, technical, and&nbsp;public-private&nbsp;collaboration to dismantle&nbsp;industrial-scale&nbsp;cybercrime operations.&nbsp;&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2011\/07\/05\/battling-the-rustock-threat\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;our report on the&nbsp;Rustock&nbsp;botnet&nbsp;&nbsp;\">Read&nbsp;our report on the&nbsp;Rustock&nbsp;botnet&nbsp;&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2011\/09\/22\/rustock-civil-case-closed-microsoft-refers-criminal-evidence-to-fbi\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;our final update on the&nbsp;Rustock&nbsp;civil case&nbsp;\">Read&nbsp;our final update on the&nbsp;Rustock&nbsp;civil case&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2011\/07\/18\/microsoft-offers-reward-for-information-on-rustock\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;the&nbsp;DCU&rsquo;s&nbsp;reward for information on&nbsp;Rustock&nbsp;\">Read more&nbsp;about&nbsp;the&nbsp;DCU&rsquo;s&nbsp;reward for information on&nbsp;Rustock&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2011\/03\/17\/taking-down-botnets-microsoft-and-the-rustock-botnet\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;on how&nbsp;the&nbsp;DCU disrupted&nbsp;Rustock&nbsp;\">Read more&nbsp;on how&nbsp;the&nbsp;DCU disrupted&nbsp;Rustock&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/ia600803.us.archive.org\/13\/items\/gov.uscourts.wawd.173532\/gov.uscourts.wawd.173532.43.0.pdf\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Learn more about&nbsp;the&nbsp;legal action against&nbsp;Rustock&nbsp;\">Learn more about&nbsp;the&nbsp;legal action against&nbsp;Rustock&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"conficker\" data-tags='[\"malware\"]' data-search=\"conficker malware conficker malware conficker&nbsp;was a&nbsp;fast-spreading&nbsp;computer&nbsp;worm exploiting unpatched windows vulnerabilities and weak passwords to propagate, disable security services, and download malware.&nbsp;at its peak,&nbsp;conficker&nbsp;infected an estimated 9&ndash;15 million computers worldwide,&nbsp;impacting&nbsp;consumers, businesses, governments, and critical infrastructure, causing remediation costs, disruption, and persistent security risk.&nbsp;to counter th\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">February 2010<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Conficker<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-d4870555 wp-block-group-is-layout-constrained\" style=\"margin-bottom:var(--wp--preset--spacing--2-xl-fluid)\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Conficker&nbsp;was a&nbsp;fast-spreading&nbsp;computer&nbsp;worm exploiting unpatched Windows vulnerabilities and weak passwords to propagate, disable security services, and download malware.&nbsp;At its peak,&nbsp;Conficker&nbsp;infected an estimated 9&ndash;15 million computers worldwide,&nbsp;impacting&nbsp;consumers, businesses, governments, and critical infrastructure, causing remediation costs, disruption, and persistent security risk.&nbsp;To counter the threat,&nbsp;the DCU&nbsp;helped launch an unprecedented&nbsp;public-private&nbsp;coalition&mdash;including Microsoft, security researchers, domain registrars, ISPs, and global CERTs&mdash;known as the&nbsp;Conficker&nbsp;Working Group, combining legal action, technical analysis, coordinated domain&nbsp;pre-registration&nbsp;and&nbsp;sinkholing, and continuous intelligence sharing to block malicious domains, prevent updates, and protect victims; the effort became a foundational model for&nbsp;collective cybercrime disruption and demonstrated how sustained collaboration can blunt even the most adaptive global malware threats.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2011\/11\/22\/microsofts-digital-crimes-unit-talks-cybercrime-with-worm-author-mark-bowden\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about the&nbsp;Conficker&nbsp;disruption&nbsp;\">Read more&nbsp;about the&nbsp;Conficker&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2009\/02\/12\/microsoft-collaborates-with-industry-to-disrupt-conficker-worm\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Conficker&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Conficker&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n\n\n<article class=\"wp-block-microsoft-timeline-timeline-item\" id=\"waledac\" data-tags='[\"malware\"]' data-search=\"waledac malware waledac malware waledac&nbsp;was&nbsp;a&nbsp;spam-centric botnet,&nbsp;a&nbsp;successor to storm, that distributed malicious email, harvested credentials, and downloaded malware via encrypted peer-to-peer command-and-control.&nbsp;waledac&nbsp;infected hundreds of thousands of computers worldwide,&nbsp;sending billions of spam messages and enabling phishing, fraud, and malware that imposed remediation costs on users, businesses, and networks.&nbsp;in 2010,&nbsp;the dcu&nbsp;led&amp;n\">\n\t\t\t<span class=\"wp-block-microsoft-timeline-timeline-item__date\">February 2010<\/span>\n\t\t\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fpuc0d436 is-layout-flow wp-block-group-is-layout-flow\" style=\"margin-top:6px;margin-bottom:var(--wp--preset--spacing--md)\" data-microsoft-breakpoint-id=\"fpuc0d436\"><h2 class=\"wp-block-heading\" style=\"margin-top:0;margin-bottom:20px;font-size:clamp(35.2px, 2.2rem + ((1vw - 3.9px) * 2.717), 64px)\">Waledac<\/h2>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-mf2qc8ko9 is-layout-flex wp-container-core-group-is-layout-32277d3e wp-block-group-is-layout-flex\" data-microsoft-breakpoint-id=\"mf2qc8ko9\"><span style=\"background-color: var(--tag-id-bg-tag-3gf5rgd, #ffa38b);color: var(--tag-id-fg-tag-3gf5rgd, var(--tag-fg-fallback))\" class=\"wp-block-microsoft-timeline-timeline-tag\" data-tag-id=\"tag-3gf5rgd\">\n\tMalware<\/span>\n<\/div>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group is-style-columns microsoft-breakpoint-id-ct6huf7qh has-global-padding is-layout-constrained wp-container-core-group-is-layout-0794605c wp-block-group-is-layout-constrained\" data-microsoft-breakpoint-id=\"ct6huf7qh\"><p class=\"wp-container-content-d387280b wp-block-paragraph\" style=\"font-size:clamp(14px, 0.875rem + ((1vw - 3.9px) * 0.189), 16px)\">Waledac&nbsp;was&nbsp;a&nbsp;spam-centric botnet,&nbsp;a&nbsp;successor to Storm, that distributed malicious email, harvested credentials, and downloaded malware via encrypted peer-to-peer command-and-control.&nbsp;Waledac&nbsp;infected hundreds of thousands of computers worldwide,&nbsp;sending billions of spam messages and enabling phishing, fraud, and malware that imposed remediation costs on users, businesses, and networks.&nbsp;In 2010,&nbsp;the DCU&nbsp;led&nbsp;its first&nbsp;coordinated disruption through civil legal action, working with ISPs, domain registrars, global CERTs, and industry security partners to seize and disable malicious domains, redirect traffic to&nbsp;Microsoft-managed&nbsp;sinkholes, and block botnet communications. The operation not only dismantled&nbsp;Waledac&rsquo;s&nbsp;infrastructure but also enabled&nbsp;victim notification and cleanup, feeding intelligence back into Microsoft protections and&nbsp;demonstrating&nbsp;how sustained legal, technical, and&nbsp;public-private&nbsp;collaboration can undo the damage caused by complex, globally distributed botnets.&nbsp;<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2010\/02\/24\/cracking-down-on-botnets\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Waledac&nbsp;\">Read more&nbsp;about&nbsp;how&nbsp;the&nbsp;DCU disrupted&nbsp;Waledac&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2010\/03\/16\/what-we-know-and-learned-from-the-takedown-of-the-waledac-botnet\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read&nbsp;our retrospective on the&nbsp;Waledac&nbsp;disruption&nbsp;&nbsp;\">Read&nbsp;our retrospective on the&nbsp;Waledac&nbsp;disruption&nbsp;&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\" style=\"margin-top:40px\"><div class=\"wp-block-button has-custom-width wp-block-button__width-100 is-style-text\"><a data-bi-ct=\"button\" class=\"wp-block-button__link wp-element-button has-inline-icon\" href=\"https:\/\/blogs.microsoft.com\/blog\/2010\/09\/08\/r-i-p-waledac-undoing-the-damage-of-a-botnet\/\" style=\"font-style:normal;font-weight:600\" target=\"_blank\" rel=\"noreferrer noopener\" data-bi-cn=\"Read more about the&nbsp;Waledac&nbsp;disruption&nbsp;\">Read more about the&nbsp;Waledac&nbsp;disruption&nbsp;<svg class=\"ignite-wp-icon ignite-wp-icon--rendered\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" fill=\"none\" viewbox=\"5.337 5.336 13.326 13.326\"><path fill=\"currentColor\" d=\"M18.663 18.337h-2V8.75l-9.912 9.912-1.414-1.414 9.912-9.912H5.663v-2h13v13Z\"><\/path><\/svg><\/a><\/div>\n<\/div>\n<\/div>\n\n<\/article>\n<\/div>\n\n\n<div data-bi-ct=\"group\" class=\"wp-block-group timeline-navigation-wrapper microsoft-breakpoint-id-t6j73lgl8 is-vertical is-layout-flex wp-container-core-group-is-layout-59e7b004 wp-block-group-is-layout-flex block-visibility-hide-small-screen\" style=\"padding-top:24px\" data-microsoft-breakpoint-id=\"t6j73lgl8\"><div data-bi-ct=\"group\" class=\"wp-block-group microsoft-breakpoint-id-fz4s1c6vq is-layout-flow wp-block-group-is-layout-flow wp-container-9 is-position-sticky\" data-microsoft-breakpoint-id=\"fz4s1c6vq\"><div class=\"timeline-nav-buttons is-sticky wp-block-microsoft-timeline-timeline-nav-buttons\" data-mode=\"multi\">\n\t<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex is-vertical\">\n\t\t<div class=\"wp-block-button is-style-outline timeline-nav-buttons__button timeline-nav-buttons__button--prev\" aria-hidden=\"true\"><button type=\"button\" class=\"wp-block-button__link wp-element-button\" aria-label=\"Previous event\"><svg width=\"14\" height=\"19\" viewbox=\"0 0 14 19\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M11.2426 0.707173L2.75732 9.19245L11.2426 17.6777\" fill=\"currentColor\"><\/path><\/svg><\/button><\/div><div class=\"wp-block-button is-style-outline timeline-nav-buttons__button timeline-nav-buttons__button--next\"><button type=\"button\" class=\"wp-block-button__link wp-element-button\" aria-label=\"Next event\"><svg width=\"14\" height=\"19\" viewbox=\"0 0 14 19\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><path d=\"M2.75691 17.6776L11.2422 9.19231L2.75691 0.707031\" fill=\"currentColor\"><\/path><\/svg><\/button><\/div>\t<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":23,"featured_media":0,"parent":3029,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_microsoft_sidebar_content":"","_microsoft_bottom_content":"","_microsoft_story_hero_content":"","_microsoft_story_content_prefix_content":"","_microsoft_story_content_suffix_content":"","_microsoft_author-bio_content":"","_microsoft_responsive_featured_images":[],"_microsoft_use_source_image":false,"_microsoft_color_scheme":"default","footnotes":""},"class_list":["post-3423","page","type-page","status-publish","hentry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Disrupting cyberthreats since 2008 | Microsoft<\/title>\n<meta name=\"description\" content=\"Explore how Microsoft\u2019s Digital Crimes Unit disrupts cybercrime and nation-state threats, protecting people, organizations, and critical infrastructure worldwide.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Disrupting cyberthreats since 2008 | Microsoft\" \/>\n<meta property=\"og:description\" content=\"Explore how Microsoft\u2019s Digital Crimes Unit disrupts cybercrime and nation-state threats, protecting people, organizations, and critical infrastructure worldwide.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Corporate Responsibility\" \/>\n<meta property=\"article:modified_time\" content=\"2026-05-21T16:09:20+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2048\" \/>\n\t<meta property=\"og:image:height\" content=\"1152\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"43 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/\",\"name\":\"Disrupting cyberthreats since 2008 | Microsoft\",\"isPartOf\":{\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-1024x576.jpg\",\"datePublished\":\"2026-05-21T16:02:52+00:00\",\"dateModified\":\"2026-05-21T16:09:20+00:00\",\"description\":\"Explore how Microsoft\u2019s Digital Crimes Unit disrupts cybercrime and nation-state threats, protecting people, organizations, and critical infrastructure worldwide.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#primaryimage\",\"url\":\"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg\",\"contentUrl\":\"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg\",\"width\":2048,\"height\":1152},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/celacampaig.wpenginepowered.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"en-us\",\"item\":\"https:\/\/celacampaig.wpenginepowered.com\/en-us\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"corporate responsibility\",\"item\":\"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Topics\",\"item\":\"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"Cybersecurity\",\"item\":\"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/\"},{\"@type\":\"ListItem\",\"position\":6,\"name\":\"Disrupting cyberthreats since 2008\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/#website\",\"url\":\"https:\/\/celacampaig.wpenginepowered.com\/\",\"name\":\"Corporate Responsibility\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/celacampaig.wpenginepowered.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/#organization\",\"name\":\"Corporate Responsibility\",\"url\":\"https:\/\/celacampaig.wpenginepowered.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/#\/schema\/logo\/image\/\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Corporate Responsibility\"},\"image\":{\"@id\":\"https:\/\/celacampaig.wpenginepowered.com\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Disrupting cyberthreats since 2008 | Microsoft","description":"Explore how Microsoft\u2019s Digital Crimes Unit disrupts cybercrime and nation-state threats, protecting people, organizations, and critical infrastructure worldwide.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/","og_locale":"en_US","og_type":"article","og_title":"Disrupting cyberthreats since 2008 | Microsoft","og_description":"Explore how Microsoft\u2019s Digital Crimes Unit disrupts cybercrime and nation-state threats, protecting people, organizations, and critical infrastructure worldwide.","og_url":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/","og_site_name":"Microsoft Corporate Responsibility","article_modified_time":"2026-05-21T16:09:20+00:00","og_image":[{"width":2048,"height":1152,"url":"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"43 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/","url":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/","name":"Disrupting cyberthreats since 2008 | Microsoft","isPartOf":{"@id":"https:\/\/celacampaig.wpenginepowered.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#primaryimage"},"thumbnailUrl":"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c-1024x576.jpg","datePublished":"2026-05-21T16:02:52+00:00","dateModified":"2026-05-21T16:09:20+00:00","description":"Explore how Microsoft\u2019s Digital Crimes Unit disrupts cybercrime and nation-state threats, protecting people, organizations, and critical infrastructure worldwide.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#primaryimage","url":"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg","contentUrl":"https:\/\/celacampaig.wpenginepowered.com\/wp-content\/uploads\/2026\/05\/54aaf1a023dc5098d6a2fbf7a0ec4b851aafb44c.jpg","width":2048,"height":1152},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/disrupting-cyberthreats-since-2008\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/celacampaig.wpenginepowered.com\/"},{"@type":"ListItem","position":2,"name":"en-us","item":"https:\/\/celacampaig.wpenginepowered.com\/en-us\/"},{"@type":"ListItem","position":3,"name":"corporate responsibility","item":"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/"},{"@type":"ListItem","position":4,"name":"Topics","item":"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/"},{"@type":"ListItem","position":5,"name":"Cybersecurity","item":"https:\/\/celacampaig.wpenginepowered.com\/en-us\/corporate-responsibility\/topics\/cybersecurity\/"},{"@type":"ListItem","position":6,"name":"Disrupting cyberthreats since 2008"}]},{"@type":"WebSite","@id":"https:\/\/celacampaig.wpenginepowered.com\/#website","url":"https:\/\/celacampaig.wpenginepowered.com\/","name":"Corporate Responsibility","description":"","publisher":{"@id":"https:\/\/celacampaig.wpenginepowered.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/celacampaig.wpenginepowered.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/celacampaig.wpenginepowered.com\/#organization","name":"Corporate Responsibility","url":"https:\/\/celacampaig.wpenginepowered.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/celacampaig.wpenginepowered.com\/#\/schema\/logo\/image\/","url":"","contentUrl":"","caption":"Corporate Responsibility"},"image":{"@id":"https:\/\/celacampaig.wpenginepowered.com\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/pages\/3423","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/comments?post=3423"}],"version-history":[{"count":0,"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/pages\/3423\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/pages\/3029"}],"wp:attachment":[{"href":"https:\/\/celacampaig.wpenginepowered.com\/wp-json\/wp\/v2\/media?parent=3423"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}