Microsoft disrupted cyberattacks orchestrated by a Russia-linked state-sponsored threat actor against Ukrainian entities including media organizations.
The tech giant said it obtained a court order allowing it to take control of seven domains used by the group, which it tracks as Strontium (aka Fancy Bear, APT28, Pawn Storm, Sofacy Group, Sednit, or Tsar Team) to attack targets in Ukraine.
“We have since re-directed these domains to a sinkhole controlled by Microsoft, enabling us to mitigate Strontium’s current use of these domains and enable victim notifications,” Microsoft corporate vice president Tom Burt said in a blog post.
Besides Ukraine, the group was observed targeting government institutions and think tanks in the US and the EU involved in foreign policy. The goal of these attacks was to establish long-term access to the victims’ systems, provide tactical support for the physical invasion and exfiltrate sensitive data.
This latest effort is part of an ongoing campaign aimed at the disruption of internet infrastructure used by Strontium. Microsoft said it established a legal process that enables it to obtain rapid court decisions for this work.
“Prior to this week, we had taken action through this process 15 times to seize control of more than 100 Strontium controlled domains,” the tech giant said.
Microsoft also noted that since the start of the Russia-Ukraine war, it observed nearly all of Russia’s nation-state actors engaged in the ongoing full-scale offensive against Ukraine’s government and critical infrastructure.
Cybersecurity Help statement on the critical situation in Ukraine
On February 24, people in many cities and towns across Ukraine woke up to the sounds of explosions and artillery fire, as the Russian Federation launched a full-scale invasion of the country. Such actions are unacceptable, political ambitions of any man aren’t worth of blood, tears, and destruction of millions of lives. We give our full support to the Ukrainian people in these hard times. No more war! Слава Україні!