Microsoft Yanks Suspected Russian-Intelligence Domains

Microsoft has pulled the plug on domains it suspected as fronts for Russian Intelligence. The company says the targets were US conservative groups.

Microsoft, riding the latest wave of security theatre, has announced that it has shut down some domains that it asserts were set up by the Strontium group (a confederate of the Russian GRU) so that it could conduct phishing operations.
The domains included close similarities to conservative think tanks, as well as US Senate operations. The pulled domains are my-iri.org, hudsonorg-my-sharepoint.com, senate.group, adfs-senate.services, adfs-senate.email and office365-onedrive.com.
In the
announcement
, Microsoft said that the Digital Crimes Unit (
DCU
) carried out a court order to enable this domain transfer and noted that they have used this approach 12 times in the last two years to shut down 84 fake websites associated with this group.
They also say a special master appointed by a federal judge concluded in the recent court order obtained by DCU, saying that there is good cause to believe that Strontium is likely to continue its conduct. No active phishing attacks were associated with the removed domains.
Nikita Karimov via Unsplash
This action raises a meta-question: Why is Microsoft taking actions affecting national security that involve a court? Is this not something that some governmental entity like the FBI should be involved in rather than a private business?
MSFT has already announced its Defending Democracy Program with some fanfare in April. It paints itself as a concerned participant looking to bring people and expertise together from across governments, political parties, campaigns and the tech sector. While cybersecurity starts with Microsoft and other companies in the tech sector, its ultimately a shared responsibility with customers and governments around the world.
They seem to want their influence felt around the world. All of it.
Microsoft has a checkered history regarding individual rights. It has long been suspected of having backdoors in its products that could be exploited by authorities. This seeming change to an altruistic view of the political process may leave some unconvinced about Microsofts true motivation.
But many of the leading tech companies (like Amazon, Apple, Facebook, Microsoft and Twitter) did have a meeting in April with intelligence community representatives about what tech companies could be doing to counter election manipulation. So, its not just Microsoft involved in this effort.
It is not inconceivable that this latest Microsoft action was done at the behest of the intelligence community, using Microsoft as a cover.
But Microsoft has its own private agenda. The AccountGuard service that it has established as part of the Defending Democracy program will only work with Office 365 users, for example.
They say the
AccountGuard service
provides best practices and guidance, and may provide notification of a nation state attack. This service does not make a participant hack-proof -- it is the customers responsibility to manage security.
Giving service to its users is what any company should do. Yet making pre-emptive judgments about national security situations is beyond its rightful sphere. In this case, the outcome may be beneficial, though normalizing a companys dealing with common threats is a dangerous precedent that may not work out so well the next time it happens.
Related posts:
Congressional Campaign Websites Vulnerable to Attack, Say Researchers
Cryptomining Malware, Cryptojacking Remain Top Security Threats
Trend Micro Finds 89 Malicious Chrome Extensions Dispensing Malvertising
Adware & Cryptomining Remain Top Enterprise Security Threats
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ Sony, XBox Targeted by DDoS Attacks, Hacktivist Threats ◂ Discovered: 23/12/2024 Category: security	▸ There are plenty of online tools for reporting bugs. ◂ Discovered: 23/12/2024 Category: security	▸ 27 Million South Koreans Hit by Online Gaming Theft. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Yanks Suspected Russian-Intelligence Domains