Microsoft seized seven domains belonging to Strontium, also referred to as Fancy Bear or APT28, a Russian hacking group with ties to the nation’s army intelligence company, the corporate introduced in a blog post (by way of TechCrunch). According to Microsoft, Russian spies used these websites to focus on Ukrainian media shops, in addition to overseas coverage suppose tanks and authorities establishments positioned within the US and the European Union.

Microsoft obtained a courtroom order to take management of every area on April sixth. It then redirected them to a sinkhole, or a server utilized by cybersecurity consultants to seize and analyze malicious connections. The firm says it has seized over 100 domains managed by Fancy Bear earlier than this most up-to-date takedown.

“We believe Strontium was attempting to establish long-term access to the systems of its targets, provide tactical support for the physical invasion and exfiltrate sensitive information,” Tom Burt, Microsoft’s company vice chairman of buyer safety and belief stated within the publish. “We have notified Ukraine’s government about the activity we detected and the action we’ve taken.”

This specific hacking group has an extended historical past of making an attempt to intrude with each Ukraine and the US. Fancy Bear was linked to cyberattacks on the Democratic National Committee in 2016 and focused the US election in 2020.

Russia’s invasion of Ukraine has solely exacerbated cyberattacks by Fancy Bear and different dangerous actors. Last month, Google stated Fancy Bear and Belarusian hacking group Ghostwriter carried out a phishing assault focusing on Ukrainian officers and members of the Polish army. Russian state-sponsored hackers have additionally been accused of hacking right into a European satellite tv for pc service initially of Russia’s invasion of Ukraine, in addition to focusing on US protection contractors in February. It’s unclear whether or not Fancy Bear was behind both assault.