For a while, the people behind Thallium had a quiet, effective routine. They sent an email that looked like it came from Microsoft, the recipient clicked a link, and a sign-in page asked for the password. Then the attackers walked into the account themselves.
Microsoft says that routine has now been cut off. The company announced that it took control of 50 domains Thallium used, a group believed to operate from North Korea and described by ZDNet as government-backed. On December 18, Microsoft filed a lawsuit against Thallium in a Virginia court. Shortly after Christmas, US authorities granted the order that let it take over the domains. Tom’s Hardware identified the court as the US District Court for the Eastern District of Virginia.
Who was targeted
Microsoft’s Digital Crimes Unit and its Threat Intelligence Center had watched the group for months, mapping a network of websites, domains and internet-connected computers. In the words of Tom Burt, a Microsoft corporate vice president, “the targets included government employees, think tanks, university staff members, members of organizations focused on world peace and human rights, and individuals that work on nuclear proliferation issues.” Most were in the US, he said, along with some in Japan and South Korea.
What the attackers did with a password
Inside a compromised account, Microsoft said, Thallium could “review emails, contact lists, calendar appointments and anything else of interest.” It also set up a mail forwarding rule that sent every new message to accounts the group controlled.
That rule matters. It keeps working even if the victim loses access or changes the password, which Tom’s Hardware pointed out: how many people, after changing a password, would also check their forwarding rules?
Burt said the end goal in many attacks was malware, specifically two remote access trojans called KimJongRAT and BabyShark. Once on a victim’s computer, he said, the software “exfiltrates information from it, maintains a persistent presence and waits for further instructions.”
Not Microsoft’s first
ZDNet noted that Microsoft has used court orders against government-backed groups before. It went to court 12 times against the Russian group Strontium, also known as APT28 or Fancy Bear, and took down 84 domains, the last in August 2018. It also seized 99 domains run by Phosphorus (APT35), which is linked to Iran. Actions against the Chinese group Barium were also reported, though details are thin.
Tom’s Hardware was blunt about the limits. Thallium could register more domains, and it would probably take Microsoft some time to spot them, let alone win another order. Actions like this interrupt threat groups, the site wrote. They do not end them.
Sources
- Microsoft Seizes 50 Domains Used by North Korean Hackers
- Microsoft takes down 50 domains operated by North Korean hackers – ZDNET
