The email said it came from microsoft.com. It came from rniscroft.com. Squeeze an “r” and an “n” together and, at a glance, you get an “m”.
That small trick was one of the lures used by Thallium, a North Korean hacking group, according to Microsoft. The company said a US District Court has now ordered that it may take control of 50 web domains the group used, and it announced the order in a blog post on Monday.
How the scheme worked
Thallium sent phishing emails: messages built to look legitimate so the reader clicks a link. In the example Microsoft published, the email warned of “unusual sign-in activity” on the recipient’s account. The link led to a page asking for login credentials, and with those the hackers could get into the victim’s computer and personal information.
The group also installed malware on victims’ devices. Microsoft named two strains, BabyShark and KimJongRAT.
Microsoft’s Digital Crimes Unit and its Threat Intelligence Center had been watching the group. They found a network of websites, domains and computers used to break into personal machines.
Who was targeted
Most of the victims were in the United States, with some in Japan and South Korea. Microsoft listed US officials, think tanks, university staff, people working on nuclear technology and members of peace organizations.
Thallium is the fourth state-linked group Microsoft has taken action against in this way. The company has done the same to hacking groups in Russia, China and Iran.
