{"id":44289,"date":"2021-12-06T23:14:11","date_gmt":"2021-12-06T23:14:11","guid":{"rendered":"http:\/\/784ba93d-becd-460d-a1c3-b80306cdf03e"},"modified":"2021-12-06T23:14:11","modified_gmt":"2021-12-06T23:14:11","slug":"microsoft-seizes-domains-used-to-attack-29-governments-across-latin-america-caribbean-europe","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-seizes-domains-used-to-attack-29-governments-across-latin-america-caribbean-europe\/","title":{"rendered":"Microsoft seizes domains used to attack 29 governments across Latin America, Caribbean, Europe"},"content":{"rendered":"

Microsoft has announced the seizure of dozens of domains used in attacks by the China-based APT group Nickel on governments and NGOs across Europe, the Americas and the Caribbean. <\/p>\n

In two blog posts<\/a> published on Monday<\/a>, Microsoft vice president Tom Burt, the Microsoft Digital Crimes Unit and the Microsoft Threat Intelligence Center said they have been tracking Nickel since 2016 and that a federal court in Virginia granted the company’s request to seize websites the group was using<\/a> to attack organizations in the US and and other countries.<\/p>\n

Burt explained that on December 2, the company filed lawsuits<\/a> in the US District Court for the Eastern District of Virginia that would allow them to “cut off Nickel’s access to its victims and prevent the websites from being used to execute attacks.” <\/p>\n

“We believe these attacks were largely being used for intelligence gathering from government agencies, think tanks and human rights organizations,” Burt said. <\/p>\n

“The court quickly granted an order that was unsealed today following completion of service on the hosting providers. Obtaining control of the malicious websites and redirecting traffic from those sites to Microsoft’s secure servers will help us protect existing and future victims while learning more about Nickel’s activities. Our disruption will not prevent Nickel from continuing other hacking activities, but we do believe we have removed a key piece of the infrastructure the group has been relying on for this latest wave of attacks.”<\/p>\n

\"fig1-nickel-targeted-countries.png\"<\/span>