On December 18, 2019, Microsoft announced that it had assumed ownership of 50 Internet domains that were being used by a North Korean‑affiliated hacking outfit it has labeled “Thallium.” The takeover followed a favorable ruling by a United States federal judge, which granted the tech giant legal authority to seize the sites and thus disrupt the group’s phishing campaign.
According to Tom Burt, Microsoft’s corporate vice president of customer security and trust, the fraudulent sites were crafted to look like legitimate services, employing addresses such as “hotrnall.com,” “office356‑us.org” and “mai1.info.” These domains were used to lure victims into entering credentials on counterfeit login pages, enabling the hackers to harvest sensitive data. Burt explained the attack chain in a blog post: the perpetrators first harvested personal details from social‑media profiles and other publicly available sources.
Using that information, they generated targeted emails that appeared to originate from trusted organizations. The messages contained links to the spoofed websites, where unsuspecting users believed they were accessing genuine services and entered their login information. The campaign was not limited to a handful of individuals.
Victims were primarily located in Japan, the United States and South Korea, indicating a broad, multi‑regional operation. The group’s methodology followed a classic phishing playbook—reconnaissance, tailored phishing emails, and fake login portals—but was executed at a scale consistent with a state‑sponsored actor.
Microsoft’s seizure of the 50 domains marks the fourth instance in which the company has used legal action to dismantle infrastructure belonging to a foreign hacking group. Earlier actions targeted groups linked to China, Iran and Russia. In each case, Microsoft filed a lawsuit in U.S. federal court, argued that the domains were being used for fraud and intellectual‑property theft, and obtained a court order that transferred control of the domains to Microsoft. Once in possession, the company redirected traffic away from the malicious sites, effectively cutting off the attackers’ ability to use that infrastructure.
While the seizure does not permanently eliminate the threat—hackers can register new domains and rebuild their infrastructure—it imposes a significant operational setback. The disruption forces the group to start anew, incurring additional time and financial costs, and signals that Microsoft is prepared to pursue aggressive legal remedies against state‑backed cyber actors.
Microsoft’s approach underscores a broader strategy of confronting nation‑state hackers through a combination of technical expertise, legal resources and court orders. The company’s legal team argues that the domains facilitate fraud and the theft of intellectual property, a position that has repeatedly been upheld by U.S. courts. Although the 50 seized domains are now under Microsoft’s control and the immediate phishing threat from those sites has been neutralized, the underlying threat from the Thallium group remains.
North Korea’s cyber capabilities extend beyond a handful of counterfeit websites; the nation has a documented history of sophisticated cyber‑espionage, financial theft and system disruption. The recent court‑backed domain seizure represents a tactical victory for Microsoft and a temporary reprieve for potential victims in the affected regions.
However, the broader cyber conflict with North Korean actors continues, and the effectiveness of this legal‑centric tactic over the long term remains to be seen.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Microsoft seizes 50 North Korean hacker domains in court victory”, “description”: “On December 18, 2019, Microsoft announced that it had assumed ownership of 50 Internet domains that were being used by a North Korean‑affiliated hacking outfit “, “datePublished”: “2026-06-26T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Sophie King”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}, “image”: “https://americansuntimes.com/wp-content/uploads/sites/19/2026/06/companion_96.jpg”}
