Microsoft says it has successfully dismantled the infrastructure of a cybercrime operation that sold access to fraudulent Outlook accounts to other hackers, including the notorious Scattered Spider gang.
The group, tracked by Microsoft as “Storm-1152”, is described as a major player in the cybercrime as a service (CaaS) ecosystem, whereby criminals provide hacking and cybercrime services to other individuals or groups. Storm-1152 created for sale approximately 750 million fraudulent Microsoft accounts through its “hotmailbox.me” service to earn “millions of dollars in illicit revenue” and cause “millions of dollars in damage to Microsoft,” according to the company. The tech giant described the operation as the “number one seller and creator of fraudulent Microsoft accounts.”
Microsoft described this operation as a “scheme to use Internet ‘bots’ to hack into and deceive Microsoft’s security systems into believing that they are legitimate human consumers of Microsoft services, open Microsoft Outlook email accounts in names of fictitious users, and sell those fraudulent accounts to cybercriminals.”
The group also operated rate solver services for CAPTCHAs, including “1stCAPTCHA,” “AnyCAPTCHA,” and “NoneCAPTCHA,” according to Microsoft. Storm-1152 promoted these solvers as a way to bypass any type of CAPTCHA, enabling fraudsters to abuse the online environments of Microsoft and enterprises in other industries.
Microsoft said it had identified several ransomware and extortion groups utilizing Storm-1162’s services, including Octo Tempest, better known as Scattered Spider.
Microsoft said in a court order obtained on December 7 that its investigation into Storm-1152 revealed that Scattered Spider hackers also recently committed “massive ransomware attacks against flagship Microsoft customers,” resulting in service disruptions that inflicted hundreds of millions of dollars of damage.
Storm-1152’s services have also been used by cybercriminal groups “to injure not just Microsoft, but numerous other technology companies like X (formerly Twitter) and Google and their customers,” according to the complaint.
Microsoft announced on Wednesday that it had successfully seized Storm-1152’s U.S.-based infrastructure and domains after obtaining the court order from the Southern District of New York.
The company said it had also identified the individuals behind Storm-1152’s operations. These individuals, named Duong Dinh Tu, Linh Van Nguyễn (also known as Nguyễn Van Linh), and Tai Van Nguyen, are based in Vietnam, according to Microsoft.
“With today’s action, our goal is to deter criminal behavior,” April Hogan-Burney, general manager of Microsoft’s Digital Crimes Unit said. “By seeking to slow the speed at which cybercriminals launch their attacks, we aim to raise their cost of doing business while continuing our investigation and protecting our customers and other online users.”
Microsoft was assisted in its takedown of Storm-1152 by San Francisco-based cybersecurity company Arkose Labs, which said it had been tracking the operation since August 2021.
“Storm-1152 is a formidable foe established with the sole purpose of making money by empowering adversaries to commit complex attacks,” Kevin Gosschalk, founder and CEO of Arkose Labs, said in a statement sent to TechCrunch.
“The group is distinguished by the fact that it built its CaaS business in the light of day versus on the dark web. Storm-1152 operated as a typical internet going-concern, providing training for its tools and even offering full customer support. In reality, Storm-1152 was an unlocked gateway to serious fraud.