Microsoft sues over trademark to stop COVID-19 hacking campaign

Microsoft announced on Tuesday that legal action had been taken to stop a widespread COVID-19-related hacking campaign. The lawsuit, which was brought before the US District Court for the eastern Virginia district, allowed the technology giant to take control of domains that hackers use to trick their victims.

Cyber ​​attacks have increased during the corona virus pandemic as more people work from home and most business conversations take place online. Infectious disease related scams have flooded the internet. The FBI’s Internet Crimes Complaint Center has received 20,000 reports of corona viruses this year.

Microsoft said it worked to stop a hacking campaign against companies in 62 countries with COVID-19 cyber attacks. In a blog post on Tuesday, Tom Burt, corporate vice president of customer security and trust at Microsoft, said the campaign had sent millions of phishing emails to potential victims.

The technology giant said he discovered the hacking campaign for the first time in December and changed tactics to focus on COVID-19 and trick his victims over the course of the plans. The emails would present themselves as business talks and send files like “Q4 Report – Dec19”.

If someone fell for the trick, they were asked to give permissions to a fake app called “0365 Access” as Office 365. This allows hackers to view emails and notes and have full access to files and contacts in the account. The attackers used this access to steal corporate information and redirect transfers, according to Microsoft’s lawsuit filed on June 30.

After the pandemic began, the attacks used COVID-19 as traps, with files like “COVID-19 Bonus.xlsx” attached to the emails. The attacks were based on court records against executives and business leaders. The company declined to indicate how many people clicked the links.

Microsoft said it stopped this hacking campaign by suing to take over the domains that claim to be the company. His lawsuit alleges that the hackers have misused Microsoft’s name and trademark in their system. The company found at least six domain names that pretended to be Microsoft’s website to trick victims.

“This unique civil action against COVID-19-themed BEC attacks has allowed us to proactively disable key domains that are part of the criminals’ malicious infrastructure. This is a critical step in protecting our customers,” said Burt.

This is not the first time Microsoft has used the courts to block hacking efforts. In December, Microsoft announced a lawsuit against North Korean hackers to take over 50 domains pretending to come from the technology giant. This also applies to hacking groups from Russia and Iran.

A Microsoft spokesman said the COVID-19-related scams weren’t from a nationwide attacker, but refused to comment on who was behind the hacking campaign.