U.S. Takes Down Websites Used by Russian-Linked Hackers

In a significant move to counter cyber-espionage, the U.S. Department of Justice, in collaboration with Microsoft, has taken down over 100 domains associated with Star Blizzard, a Russian hacking group tied to the FSB. Star Blizzard has been targeting American officials, nonprofits, think tanks, and military contractors through spear-phishing campaigns since 2017. The group employed these websites to appear as trusted contacts, seeking to infiltrate systems and steal sensitive information. Microsoft has been tracking Star Blizzard’s activities for years, noting the group’s sophisticated evasion tactics.

Star Blizzard has been actively involved in espionage across Europe and NATO countries, often targeting entities supporting Ukraine. Their tactics include detailed reconnaissance of victims to craft convincing phishing emails, making their activities particularly challenging to detect. These emails aimed to gain access to internal systems for data theft and disruption.

The recent takedown was enabled by a court order after a lawsuit filed by Microsoft and the NGO-Information Sharing and Analysis Center, which worked together to uncover Star Blizzard’s operations. Deputy Attorney General Lisa Monaco emphasized that the Russian government ran this scheme to steal Americans’ sensitive information by using seemingly legitimate emails to deceive their targets. She also reiterated the importance of partnerships with the private sector in exposing and neutralizing such cyber threats.

Microsoft noted that Star Blizzard’s methods were persistent and elusive, complicating countermeasures by cybersecurity professionals. Despite their efforts to adapt and conceal their identity, the U.S. actions have disrupted their infrastructure, limiting their ability to continue these campaigns. However, the expectation remains that Russia will keep deploying similar tactics against the U.S. and its allies, emphasizing the need for continued vigilance.

Star Blizzard’s cyber-espionage activities included targeting high-profile American military contractors and even the Department of Energy, which oversees nuclear programs. Their sophisticated approach involved extensive research into their targets, ensuring that phishing attempts appeared as credible as possible. Previous campaigns linked to the group involved attacks against U.K. lawmakers, highlighting their broader agenda of espionage across Western countries. Microsoft’s ongoing monitoring has been key to countering Star Blizzard’s cyber threats, as the group’s ability to obfuscate and adapt has posed a continuous challenge for cybersecurity professionals.