- Cummins back, Marsh and Head out of Pakistan ODI series
- Shanghai stocks swing after stimulus briefing as most of Asia rises
- New Zealand's Latham promises 'no fear' as he takes charge for India Tests
- Kyrgios vows to 'shut up' doubters with December comeback
- Public hearings start into death of Brit by Russian nerve agent
- Ex-Stasi officer faces verdict over 1974 Berlin border killing
- Role of government, poverty research tipped for economics Nobel
- 'Stolen satire' feeds US election misinformation
- Rookie McCarty captures first PGA Tour title in Black Desert Championship
- Australia all-rounder Green ruled out of India Test series
- Seeing double in Nigeria's 'twins capital of the world'
- UK FM to attend EU foreign affairs talks for first time in 2 years
- Carter, Billups among 13 new Basketball Hall of Fame inductees
- Ravens rip Commanders as Lions lose NFL sacks leader in win
- Hezbollah drone strike kills four, wounds dozens at Israeli base
- China says launches military drills around Taiwan
- Stewart leads Liberty past Lynx to level WNBA Finals
- England return to winning ways in Nations League, Austria thrash Norway
- UN chief says attacks on UNIFIL 'may constitute a war crime'
- Ravens outlast Commanders while Bucs batter Saints in NFL
- Dozens hurt in Israel as Hezbollah claims drone strike
- England deserve 'world class' coach: Carsley
- Burkina Faso win to become first qualifiers for 2025 AFCON
- AC Milan's Pulisic among five out for USA match in Mexico
- France's Amandine Henry retires from international football
- Centre-left set to win pro-Ukraine Lithuania's vote
- India's World Cup hopes in Pakistan hands after Australia defeat
- Zelensky says NKorea sending troops to Russian army
- England beat Finland to get back on track
- King and Lewis propel West Indies to T20 triumph over Sri Lanka
- Pre-Halloween 'Terrifier' lands atop North America box office
- 'I still plan to compete and play next season,' says Djokovic
- Harris, Trump seek advantage in knife-edge election battle
- Chepngetich shatters women's marathon world record in Chicago
- Kamindu and Asalanka power Sri Lanka to 179 against West Indies
- Chepngetich shatters women's marathon world record as Korir wins in Chicago
- Spain send injured Yamal home 'to prioritise player's health'
- In milestone, SpaceX 'catches' megarocket booster after test flight
- Iraq walks fine line with pro-Iran factions to avoid war
- Race four abandoned after New Zealand breeze into 3-0 lead in America's Cup
- West Indies win toss, put Sri Lanka in to bat in first T20
- Sudan rescuers say air strike killed 23 in Khartoum market
- Netanyahu tells UN to move Lebanon peacekeepers out of 'harm's way'
- Bangladeshi Hindus defy attack worries to celebrate festival
- Kiwis three up in America's Cup as Ineos pay for time penalty
- In a first, SpaceX 'catches' megarocket booster after test flight
- Dominant England crush Scotland at Women's T20 World Cup
- Dropped: The rise and fall of Pakistan batting maestro Babar Azam
- Israel fights Hezbollah on the ground, pounds Lebanon from the air
- Sabalenka outlasts local hero Zheng to win third Wuhan Open title
What is Storm-1152, alleged top creator of fake Microsoft accounts?
Microsoft has seized the websites of a Vietnam-based group it alleges sold millions of fake accounts to cybercriminals who used them for ransomware attacks, identity theft and other scams around the world.
The group, identified by Microsoft as Storm-1152, developed sophisticated tools to defeat the US tech giant's security features to set up fraudulent Outlook and Hotmail email accounts in bulk.
Who is in Storm-1152?
Storm-1152 was first detected in 2021. Arkose Labs, the cybersecurity firm that worked with Microsoft against the group, tracked it to Vietnam.
The leaders of the group are three Vietnam-based individuals, Duong Dinh Tu, Linh Van Nguyen and Tai Van Nguyen, Microsoft said in a statement on Wednesday. It is not clear if there are any other members.
AFP has asked the three for a response on email addresses listed in Microsoft's complaint against them in a US federal court last week.
AFP has also contacted Vietnamese authorities for comment.
How did they make millions of accounts so rapidly?
Storm-1152 developed automated software -- or "bots" -- to create fake accounts.
These bots defeated Microsoft's safeguards, such as the CAPTCHA puzzles users have to solve to prove they are human, the tech giant said in its court filing.
Storm-1152 is "the number one seller and creator of fraudulent Microsoft accounts", creating around 750 million to date, the company said Wednesday.
Microsoft's court filing included a screenshot of a Storm-1152 website that boasts the use of artificial intelligence against CAPTCHA.
The group created accounts "at a scale so large, fast, and efficient that it could have only been carried out through automated, machine-learning technology", Patrice Boffa, chief customer officer at Arkose Labs, said in a statement.
Who needs so many fake email accounts?
Storm-1152 pursued a model called "cybercrime-as-a-service" or CaaS, acting as a provider to other criminal groups, Microsoft and Arkose said.
With tech companies improving their detection and deletion of fake accounts, cyber attackers need huge amounts to carry out their operations.
"Instead of spending time trying to create thousands of fraudulent accounts, cybercriminals can simply purchase them from Storm-1152 and other groups," Microsoft's Amy Hogan-Burney said in a blog post.
Storm-1152 allegedly made millions of dollars from the operation.
What did Storm-1152's customers do with fake accounts?
The group's customers have used fake email accounts for a variety of crimes, according to Microsoft and Arkose Labs.
These include phishing attacks to either steal information or insert malware on devices.
Its customers have also used these accounts to install ransomware and demand payment from victims, according to Microsoft.
The highest-profile customer named in Microsoft's court filing is a group known as Octo Tempest, which has been linked to a wave of cybercrimes in recent years.
Octo Tempest recently launched ransomware attacks against Microsoft customers that "inflicted hundreds of millions of dollars of damage", the company said in its court filing, without naming the victims.
Google and X, formerly known as Twitter, have also been hit by Storm-1152 activities, Microsoft said in the filing.
Was it hard to find Storm-1152?
Unlike many cybercriminals that offer such services on the so-called dark web, hidden away from general users, Storm-1152's websites were on the open web.
It offered its services on at least two websites, according to Microsoft, and even had step-by-step user guides.
Duong Dinh Tu, one of the defendants, also had a YouTube channel with a video demonstration, and the group would edit the code for their anti-CAPTCHA software on GitHub -- a Microsoft-owned internet depository for software.
Microsoft said it also hired cybercrime experts to make undercover purchases of accounts and CAPTCHA-beating tools from Storm-1152 websites.
A US court allowed Microsoft to take control of the group's sites in response to the company's complaint last week.
The sites now say: "This Domain has been seized by Microsoft."
P.Martin--AMWN