Microsoft seizes domain used by Vietnamese group to sell fake accounts, services | CyberScoop<\/title> <meta name=\"description\" content=\"Court documents reveal Microsoft\u2019s latest move to combat an operation that used fraudulent accounts to skirt CAPTCHA services.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Microsoft seizes domain used by Vietnamese group to sell fake accounts, services \"> <meta property=\"og:description\" content=\"Court documents reveal Microsoft\u2019s latest move to combat an operation that used fraudulent accounts to skirt CAPTCHA services.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-07-31T23:57:59+00:00\"> <meta property=\"article:modified_time\" content=\"2024-07-31T23:58:00+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1721926675g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1721767167g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1721764637g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ada0ad45b21fc79c6694\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/81261\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.6.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=81261\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fmicrosoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fmicrosoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-81261 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.952380952381\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2024 CyberScoop 50 awards! <\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/vote\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.353075170843\">\n<div class=\"single-article__header-content\" readability=\"30.501992031873\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> Court documents reveal Microsoft\u2019s latest move to combat an operation that used fraudulent accounts to skirt CAPTCHA services. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> A view of the Microsoft corporate logo in front of the Microsoft Office building on 41st street and 8th avenue on July 19, 2024 in New York City. (Photo by Craig T Fruchtman\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"49.315482502651\"><body readability=\"99.664805716838\"><\/p>\n<p>Microsoft on Wednesday seized another domain used by a trio of people based in Vietnam who were selling fraudulent accounts and services to bypass CAPTCHA puzzles, according to court documents unsealed late Wednesday. <\/p>\n<p>The seizure of a single domain \u2014 rockcaptcha[.]com \u2014 comes six months after a federal court authorized Microsoft to seize domains and infrastructure operated by the same group that was responsible for creating roughly 750 million fraudulent Microsoft accounts and CAPTCHA bypass services that were then used to facilitate a bevy of cybercrime activities, <a href=\"https:\/\/cyberscoop.com\/microsoft-seizes-infrastructure-of-top-cybercrime-group\/\">Microsoft said at the time<\/a>.<\/p>\n<p>Microsoft identified three Vietnamese citizens as being behind the operations and tracked the activity under the name \u201cStorm-1152.\u201d Accounts purchased from Storm-1152 were used as part of ransomware attacks and data theft and extortion, including activities emanating from the Scattered Spider ecosystem, Amy Hogan-Burney, Microsoft\u2019s general manager and associate general counsel for cybersecurity policy and protection, <a href=\"https:\/\/blogs.microsoft.com\/on-the-issues\/2023\/12\/13\/cybercrime-cybersecurity-storm-1152-fraudulent-accounts\/\">wrote in a blog post at the time<\/a>.<\/p>\n<p>Investigators with Microsoft\u2019s Digital Crimes Unit recently found a blog post, written in Vietnamese, discussing how that disruption significantly impacted the previous services, according to <a href=\"https:\/\/landingpage-h0gcc3bvhkd2aaez.z01.azurefd.net\/1152\/Lyons%20Decl.%20ISO%20Mot.%20for%20Suppl.%20PI.pdf\">a court filing written by Jason Lyons<\/a>, principal manager of investigations in the DCU. The blog post, published Jan. 29, 2024, unveiled a new website that offered essentially the same services. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cMy team has more than 15 years of experience in AI research (can be said to be the first generation), can create AI models to process a series of captchas at super fast speed and high accuracy rate,\u201d the post read, according to machine translation. \u201cIn addition to AI, our team is also confident in being able to reverse-engineer all types of source code and be self-sufficient in all aspects of technology. With the above strengths, rockcaptcha.com is confident in bringing you a truly smooth service experience as well as reasonable prices.\u201d<\/p>\n<p>The authors of the post are the same people responsible for the previous operation that generated 750 million fraudulent Microsoft accounts, Lyons said. The reconstituted operation operated \u201con a much lesser scale, with far fewer customers,\u201d Lyons said in the filing, but seizing the domain was important because it would \u201cfurther frustrate Defendants\u2019 efforts to maintain and add customers, weaken their credibility in the marketplace, and ultimately cause the Fraudulent Enterprise to fail.\u201d<\/p>\n<p>The operation generated roughly 1 million new Microsoft accounts per week prior to the December 2023 disruption, a Microsoft spokesperson said. Since December, Storm-1152 generated about 1 million accounts total.<\/p>\n<p>A federal judge in the <a href=\"https:\/\/landingpage-h0gcc3bvhkd2aaez.z01.azurefd.net\/1152\/Suppl.%20PI%20Order.pdf\">Southern District of New York approved the seizure<\/a> on July 23, according to a court filing.<\/p>\n<p>Microsoft identified three people as leading the operation: Duong Dinh Tu, Linh Van Nguyen and Tai Van Nguyen.<strong> <\/strong>A request for comment sent to an email associated with the alleged perpetrators was not returned.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Vietnam is \u201cbecoming more of a hub for these types of services,\u201d Maurice Mason, a senior investigator in the DCU, told CyberScoop in a recent interview. While there are a variety of groups in the region offering similar services, the Microsoft investigation determined that \u201cthis group was most notorious, like they were the one that was actually getting the most services.\u201d<\/p>\n<p>Sean Farrell, lead counsel of cybercrime enforcement with the DCU, told CyberScoop that the initial takedown and ongoing monitoring of Storm-1152 highlights the service nature of the cybercrime ecosystem, with people willing to sell all manner of services to facilitate all kinds of cybercrime.<\/p>\n<p>Farrell added that the activity marks an early example of artificial intelligence used to facilitate cybercrime, as the operators were employing AI to solve CAPTCHA puzzles \u2014 which are used to reduce inauthentic, spammy behavior \u2014 in an automated fashion. Additionally, fraudulent Microsoft accounts could also be used to give cyber criminals access to other AI resources, including from Microsoft, he said, so slowing them down is a net benefit.<\/p>\n<p>\u201cIt may not look like it on its face, and I think people think of something grander or sexier, but these are the earliest indications of what actors are going to be able to do to lower that cost and the barrier to entry to cybercrime even further,\u201d Farrell said.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.1504237288136\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/08\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft seizes domain used by Vietnamese group to sell fake<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,323,2435,46,726],"tags":[286,327,2436,54,729],"class_list":["post-4684","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-extortion","category-microsoft-digital-crimes-unit","category-ransomware","category-vietnam","tag-cybercrime","tag-extortion","tag-microsoft-digital-crimes-unit","tag-ransomware","tag-vietnam"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/extortion\/\" rel=\"category tag\">extortion<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/microsoft-digital-crimes-unit\/\" rel=\"category tag\">Microsoft Digital Crimes Unit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vietnam\/\" rel=\"category tag\">Vietnam<\/a>","tag_info":"Vietnam","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=4684"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/4684\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=4684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=4684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=4684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":4684,"date":"2024-07-31T18:57:59","date_gmt":"2024-07-31T23:57:59","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=81261"},"modified":"2024-07-31T18:57:59","modified_gmt":"2024-07-31T23:57:59","slug":"microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/07\/31\/microsoft-seizes-domain-used-by-vietnamese-group-to-sell-fake-accounts-services\/","title":{"rendered":"Microsoft seizes domain used by Vietnamese group to sell fake accounts, services\u00a0"},"content":{"rendered":"