![\"A](\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/wp-content\/uploads\/2026\/06\/04-analysis-scaled-e1782248871249-1024x693.png\")
- September 2025: <\/strong>RaccoonO365<\/strong><\/a>,<\/strong> a newly launched phishing-as-a-service platform that sold phishing kits used by cybercriminals to steal Microsoft 365 usernames and passwords. The DCU’s disruption led to the arrest of the leaders of the RaccoonO365 operation and successfully eradicated the service. <\/li>\n<\/ul>
- January 2026: <\/strong>RedVDS<\/strong><\/a>,<\/strong> a subscription-based provider of cheap, disposable virtual computers that were used as launchpads for phishing and financial fraud. Coordinated legal action between the US and the UK—the DCU’s first joint civil case—took down the domains RedVDS used to host its marketplace and customer portal. The DCU worked with German law enforcement to seize RedVDS’s backend server and collaborated with international law enforcement to dismantle the network of servers and payment systems used by RedVDS customers, shutting down the service. <\/li>\n<\/ul>
- March 2026: <\/strong>Tycoon 2FA<\/strong><\/a>, a widely used phishing-as-a-service platform that enabled cybercriminals to bypass multifactor authentication and gain access to victims’ systems by using fraudulent sign-in pages that mimicked legitimate login sites for Microsoft services. The DCU seized 330 active domains that powered Tycoon 2FA, cutting off the pipeline for attacks such as data theft, ransomware, business email compromise, and financial fraud. The team coordinated with international partners to seize or disable thousands of additional domains globally. <\/li>\n<\/ul>
- May 2026: <\/strong>Fox Tempest<\/strong><\/a>,<\/strong> a service that evaded antivirus protections,<\/strong> allowing cybercriminals to disguise malware as trustworthy software by abusing tools designed to verify legitimacy. The DCU’s takedown, which seized Fox Tempest’s website, blocked access to a site hosting the underlying code, and took hundreds of virtual machines running the operation offline, has completely stopped Fox Tempest’s activity. <\/li>\n<\/ul>
- June 2026:<\/strong> Amadey and Stea<\/a>l<\/a>C<\/a><\/strong>, two different malware variants that worked together to infect systems and harvest credentials for everything from email accounts to bank accounts. Leveraging a suite of AI tools, the DCU conducted a single court-authorized disruption that seized the infrastructure powering both malware families at once. <\/li>\n<\/ul>
Each of these takedowns is significant in its own right, but together, they tell a larger story about how cybercrime operates today and what it takes to fight it: In this environment, it’s not enough to take out individual threats. Stopping cybercrime means breaking down the infrastructure that powers it. These five disruptions show how the DCU is fighting the system as a whole, targeting the providers in the CaaS supply chain that make the most damaging attacks possible. <\/p>
The DCU’s multidisciplinary team of investigators and legal experts recently got together to discuss how this unprecedented series of disruptions reflect the team’s strategic approach to the CaaS economy and what that means for the future of fighting digital crime. These are their takeaways. <\/p>
It takes an ecosystem to combat an ecosystem<\/h2>
As cybercrime has evolved from lone actors to a distributed network of tools and services, collaboration with partners in both the public and private sectors has become increasingly central to the DCU’s work. <\/p>
“The heart of the challenge is the willingness among threat actors to cooperate with each other,” says Sean Ensz, Principal Investigator with the DCU. “They realize that cooperation is the key to more successful, scalable attacks. The same has to be true for us as defenders. If they’re going to cooperate and be scalable, we have to cooperate and be scalable as well.” <\/p>
That means working with industry partners, particularly cybersecurity and threat research companies, to increase both the scale and speed of investigations. “Often our partners have different visibility than we do,” Lyons says. He teams up with peers at companies that provide antivirus tools to get a view of threat activity that’s more complete than what they would see if they only looked at data from their own users and products. Additionally, he says security companies like Cloudflare have been key to the DCU’s disruptions because of their ability to identify servers used to host criminal operations. <\/p>
“When tech companies come together, we, through economies of scale, will have more capabilities than the bad actors,” Lyons says. “That should give us an asymmetric advantage over time, but only if we work together.” <\/p>
The DCU also collaborates closely with law enforcement, including domestic partnerships with the US Secret Service and the FBI, cooperation with Europol to investigate cross-border criminal networks, and sharing information with national and regional police around the world. <\/p>
The takedown of Tycoon 2FA points to the increasingly collaborative nature of fighting cybercrime. It was the first DCU takedown coordinated through Europol’s Cyber Intelligence Extension Programme (CIEP) and brought together more than a dozen public and private-sector partners to share information, coordinate legal action across jurisdictions, identify victims, and lead emergency response.<\/p>
Follow the links in the blockchain<\/h2>
Over the last year, the DCU has systematically incorporated blockchain analysis into its toolkit. Virtually all CaaS vendors transact in cryptocurrency for supposed anonymity. But if they want to get paid, they need to create a wallet and share the address with customers. Blockchains are open source, and over time, users have developed tools that can trace the flow of funds to individual wallets. Now, whenever the DCU looks at a new target, investigators go undercover and make a purchase. Then they follow the money. <\/p>
It’s notoriously difficult for law enforcement to trace cybercrime to the individuals who are responsible, but attribution is a crucial deterrent. Blockchain analysis has become a powerful way to help law enforcement identify and arrest cybercriminals. <\/p>
“CaaS providers will use all kinds of obfuscation techniques on the blockchain to disguise their activity and make it harder for us to trace the flow of funds, but we’ve learned how to follow our purchases all the way to the threat actor’s wallet,” Mason says. “We then provide this intelligence to law enforcement, which enables them to work with cryptocurrency exchanges to gain additional insights into the threat actor—and that also gives them the ability to seize illicit proceeds.” <\/p>
DCU investigations have contributed to the seizure of millions of dollars in cryptocurrency, making business less lucrative for CaaS operators, and even helping some victims get their money back. <\/p>
Blockchain analysis in the RaccoonO365 investigation uncovered at least $100,000 in cryptocurrency payments and ultimately revealed the identities of the people who were running the service. This intelligence supported the arrest of the operators by Nigerian law enforcement. The operation didn’t just disrupt RacoonO365’s operations, it completely dismantled it. <\/p>
“Actors get spooked when real individuals are named and arrested,” says Sean Farrell, Assistant General Counsel at the DCU. “They go offline. It sends a strong message.” <\/p>
Investigate the landscape, not just the threat<\/h2>
![\"A](\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/wp-content\/uploads\/2026\/06\/03-map-scaled-e1782249055440-1024x490.png\")
The DCU’s investigations look at the connections between different CaaS services and the ways they impact victims. Source: Microsoft <\/em>Defender<\/em><\/figcaption><\/figure> The DCU’s investigations used to focus on a single cyberthreat at a time, but the goal of dismantling the enablers of cybercrime has driven a shift in strategy that gives investigators a broader, more holistic view of the CaaS ecosystem. <\/p>
“We don’t think of these services as individual silos,” Ensz says. “We look at how they are interdependent and interrelated.” <\/p>
Threat actors use CaaS services in combination. For example, RaccoonO365 and Tycoon 2FA both provided tools for phishing campaigns. But to use those tools, cybercriminals needed to send mass emails to get the phishing lures to potential victims. Investigators saw that customers of both RaccoonO365 and Tycoon 2FA frequently used virtual servers provided by RedVDS to deliver phishing campaigns. <\/p>
“The interdependence we found in these cases expanded our understanding of the connections in the CaaS supply chain,” Ensz says. “The same patterns will show up every time services are filling these gaps in the chain.” <\/p>
The DCU’s strategic shift toward this holistic understanding of cybercrime has also brought a new focus on “victimology”—identifying and understanding cybercrime victims. The network of partners on recent disruptions has expanded to include the Better Business Bureau, the American Association of Retired People, the FBI’s Internet Crime Complaint Center, and sector-specific organizations such as Health-ISAC to understand the people and industries being targeted. <\/p>
“If you go after malware, you look at the bits and bytes, but if you shift the lens to targeting fraud, that’s humans attacking humans,” Ensz says. “Understanding the victim experience gives us a more comprehensive view of the threat.” <\/p>
Find new applications of old laws<\/h2>
Since its inception over a decade ago, the DCU has pioneered the use of legal tactics to disrupt cybercrime. The law has not kept pace with the rapid evolution of technology and digital crime, so the DCU has innovated ways to apply existing laws to cybercrime—laws that were intended for things like divorce proceedings and abuse of rental property. <\/p>
The DCU’s litigators have made fruitful use of the Racketeer Influenced and Corrupt Organizations (RICO) Act, which was created to fight organized crime. RICO allows prosecutors to target multiple people in a single charge if they’re all engaged in the same criminal activity. The DCU’s legal team has successfully used RICO to justify legal action against cyberthreats like malware with a single charge that targets the developers, the distributors, and the users. <\/p>
Prior to this year, the DCU had only used RICO to target one malware or botnet at a time. But that changed when the team launched an investigation into Amadey, a malware designed to infect a system in order to deliver subsequent payloads of malware. DCU engineers built a “crawler,” a simulation of a system infected with Amadey that let them observe how the malware communicated with its command-and-control server. They watched as the server used Amadey to drop a malware called StealC onto the crawler. <\/p>
Amadey and StealC were two different malware families, created by two different CaaS providers, but they used the same servers and were clearly operating in concert. The legal team saw an opportunity to expand their use of RICO to charge anyone involved in either malware family with participating in a single criminal conspiracy. <\/p>
This was the first time the DCU targeted more than one CaaS provider in one legal complaint. “The evolution of cybercrime has driven us to be very creative,” says Richard Boscovich, the DCU’s Assistant General Counsel and lead litigator. <\/p>
Although the new application of RICO was legally and technically difficult, it’s a breakthrough that arms the DCU for the future. Boscovich points out that the CaaS ecosystem is becoming more atomized, with smaller groups providing niche services that are increasingly interdependent with other vendors. This makes it easier for them to slip under the radar, and harder for the DCU to knock out significant parts of the CaaS infrastructure. The ability to use RICO to target multiple CaaS services with a single charge will be a powerful tool for the DCU in this new environment. <\/p>
Keep the pressure on<\/h2>
The DCU’s approach to cybercrime today is the result of more than 15 years of proactively confronting threats to Microsoft customers and the broader digital ecosystem. The team has taken down countless cybercriminal operations since its creation in 2008, including 39 civil disruption actions against prominent cyberthreats.<\/a> This experience provides a deep and nuanced understanding of how cybercrime works. As the CaaS economy has expanded and become more specialized, the DCU has incorporated additional tools and tactics that let the team disrupt threats persistently, not just at the moment of an individual takedown. <\/p>
One example is an internal disruption strategy to take down Microsoft accounts that are being used for cybercriminal activity. “During DCU disruptions, we get a really good understanding of how our internal infrastructure is being used by these actors,” says Jacklynne Sienicki, Director of Data Analytics at Microsoft. “We deliver those insights to our threat hunting teams so they can detect the behaviors on an ongoing basis across all our products. It’s a way we can put continuous pressure on the ecosystem.” <\/p>
The DCU has also created the Statutory Automated Disruption (SAD) program, which leverages laws against copyright and trademark violations. The program automatically sends notices to hosting providers when their domains are used to host services like RedVDS, which abused Windows licenses. SAD lets the DCU target CaaS infrastructure on an ongoing basis. <\/p>
![\"A](\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/wp-content\/uploads\/2026\/06\/RedVDS_New-1024x469.jpg\")
The DCU’s SAD program helps ensure that threats are completely eradicated after the initial takedown. RedVDS use has been eliminated worldwide. Source: Microsoft <\/em>Defender <\/em><\/figcaption><\/figure> Boscovich says the DCU’s approach represents “a complete, holistic approach to the problem”—one that responds to the realities of industrialized crime. <\/p>
“Since day one, when the DCU program started, we’ve always viewed cybercrime as a business,” Boscovich says. “We do everything we can to make the cost of doing business super high.” <\/p>
Explore a timeline of DCU’s disruptions of major cyberthreats—and the ongoing cases and operations behind them—from 2008 to today<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Microsoft’s Digital Crimes Unit (DCU) took down five major cybercrime operations in the last nine months. Learn how these five disruptions are part of a single strategic effort to dismantle the infrastructure that supports cybercrime today.<\/p>\n","protected":false},"author":23,"featured_media":3554,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_microsoft_sidebar_content":"\n
\nShare<\/p>\n\n\n<\/div>\n\n\n\n
\nScaling cybercrime disruption through innovation and AI<\/h2>\n\n\n\n
\nRead the article<\/a><\/div>\n<\/div>\n<\/div>\n\n\n\n
\nRedVDS and the invisible infrastructure of modern cybercrime<\/h2>\n\n\n\n
\nRead the article\n
Since day one, when the DCU program started, we\u2019ve always viewed cybercrime as a business. We do everything we can to make the cost of doing business super high.<\/p>\n\n\n\n
Richard Boscovich,
Assistant General Counsel, Microsoft Digital Crimes Unit<\/p>\n<\/blockquote>\n","_microsoft_bottom_content":"\n\n\n\n![\"Richard](\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/wp-content\/uploads\/2026\/02\/image-56-1.png\")
<\/figure>\n\n\n\nMicrosoft\u2019s Digital Crimes Unit helps the law move at the speed of cybercrime<\/h3>\n<\/div>\n\n\n\n
\n\n \n Read \u201cMicrosoft\u2019s Digital Crimes Unit helps the law move at the speed of cybercrime\u201d\n <\/span>\n\n\n![\"An](\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/wp-content\/uploads\/2025\/12\/CaaSexplainer_heroart_shadowtechindustry-e1765307399142.jpg\")
<\/figure>\n\n\n\nCybercrime-as-a-Service, Explained<\/h3>\n<\/div>\n\n\n\n
- June 2026:<\/strong> Amadey and Stea<\/a>l<\/a>C<\/a><\/strong>, two different malware variants that worked together to infect systems and harvest credentials for everything from email accounts to bank accounts. Leveraging a suite of AI tools, the DCU conducted a single court-authorized disruption that seized the infrastructure powering both malware families at once. <\/li>\n<\/ul>
- May 2026: <\/strong>Fox Tempest<\/strong><\/a>,<\/strong> a service that evaded antivirus protections,<\/strong> allowing cybercriminals to disguise malware as trustworthy software by abusing tools designed to verify legitimacy. The DCU’s takedown, which seized Fox Tempest’s website, blocked access to a site hosting the underlying code, and took hundreds of virtual machines running the operation offline, has completely stopped Fox Tempest’s activity. <\/li>\n<\/ul>
- March 2026: <\/strong>Tycoon 2FA<\/strong><\/a>, a widely used phishing-as-a-service platform that enabled cybercriminals to bypass multifactor authentication and gain access to victims’ systems by using fraudulent sign-in pages that mimicked legitimate login sites for Microsoft services. The DCU seized 330 active domains that powered Tycoon 2FA, cutting off the pipeline for attacks such as data theft, ransomware, business email compromise, and financial fraud. The team coordinated with international partners to seize or disable thousands of additional domains globally. <\/li>\n<\/ul>
- January 2026: <\/strong>RedVDS<\/strong><\/a>,<\/strong> a subscription-based provider of cheap, disposable virtual computers that were used as launchpads for phishing and financial fraud. Coordinated legal action between the US and the UK—the DCU’s first joint civil case—took down the domains RedVDS used to host its marketplace and customer portal. The DCU worked with German law enforcement to seize RedVDS’s backend server and collaborated with international law enforcement to dismantle the network of servers and payment systems used by RedVDS customers, shutting down the service. <\/li>\n<\/ul>
![\"An](\"https:\/\/www.microsoft.com\/en-us\/corporate-responsibility\/wp-content\/uploads\/2026\/01\/CELA_RaccoonO365_1200x630.png\")
<\/figure>\n\n\n\n