binarypublish
Microsoft has taken action to disrupt a cyber crime group known as Storm-1152, according to the tech giant’s announcement on December 14. Storm-1152 is responsible for creating hundreds of millions of fraudulent Microsoft accounts for sale, and has played a significant role in enabling cybercrime activities such as phishing, identity theft, fraud, and distributed denial of service (DDoS) attacks.
- Microsoft obtained a court order to seize the US-based infrastructure and websites used by Storm-1152 to create and sell fraudulent Microsoft accounts.
- Cybersecurity defense company Arkose Labs collaborated with Microsoft in tracking down Storm-1152.
- Storm-1152 also allegedly offered services to bypass Captcha software, used for verifying human account creation.
- Microsoft and law enforcement have identified the alleged leaders of Storm-1152, and a criminal referral has been submitted.
Aided by data analysis, telemetry, undercover test purchases, and reverse engineering, Microsoft was able to determine the main infrastructure of Storm-1152 was hosted within the United States. The company estimates that the cybercrime group had successfully generated about 750 million fake Microsoft accounts, resulting in millions of dollars in illicit revenue. Other cybercrime groups – such as Octo Tempest (also known as Scattered Spider), and Storm-0252 – purchased these fraudulent accounts for executing illegal activities.
Microsoft took down several websites associated with Storm-1152, including Hotmailbox.me (a site selling fraudulent Microsoft Outlook accounts), and 1stCAPTCHA, AnyCAPTCHA, and NoneCAPTCHA (websites offering Captcha-bypassing services). Arkose Labs pointed out that these sites do not only sell fraudulent Microsoft accounts but also offer methods to bypass security measures on other popular technology platforms.
This action against Storm-1152 is part of a larger effort to curb cyber crime. Amy Hogan-Burney, Microsoft’s general manager and associate general counsel, cybersecurity policy and protection, warned that persistent threat actors will continue to present a significant risk to global organizations. Despite this successful disruption, Microsoft anticipates that other cybercriminals will adapt their techniques in response.
Arkose Labs revealed that Cybercrime-as-a-service (CaaS) businesses like Storm-1152 are linked to about 80% of the attack traffic seen by their security operations center team. These businesses have significantly reduced the barriers for aspiring attackers, contributing to a 167% increase in bot attacks this year, according to the firm’s analysis.
