



Hackers did so by tricking people in those organizations to click on malicious links disguised to resemble well-known brands, including Microsoft and its LinkedIn, Outlook and Windows products, Microsoft said in court filings.

Iran denies involvement

Wednesday's announcement tied the hackers to the country of Iran but not specifically to its government. A spokesman for Iran's mission to the United Nations didn't respond to an email and phone call seeking comment Wednesday. Iran has denied involvement in other hacking efforts identified by Microsoft.


Allison Wikoff, a security researcher at Atlanta-based Secureworks, said it is one of the “more active Iranian threat groups” she has observed. She said Microsoft's takedown was a big win using a practice known as “sinkholing,” which involves taking over adversary domains and analyzing their traffic to protect against future attacks.

Microsoft files suit against hackers

Microsoft sued the hacking group in U.S. District Court in Washington this month and described a hacking operation that “demonstrates skill, patience and access to resources.”


Microsoft said the group typically tries to infiltrate a target's personal accounts, not their work accounts, by luring them into clicking on a link to a compromised website or opening a malicious attachment.

Hackers used fake domain names

Hackers, the company said, used fake domain names that resembled Microsoft and other well-known brands. They also created fake social media profiles to target people. Microsoft said hackers were damaging the company by breaking into its customers' online accounts and computer networks.

U.S. District Judge Amy Berman Jackson sided with the company in a March 15 ruling, arguing that there was good cause to believe the hacking activity was harming the company, its customers and the public. The documents were unsealed Wednesday.
