Microsoft Yanks Suspected Russian-Intelligence Domains

Microsoft has pulled the plug on domains it suspected as fronts for Russian Intelligence. The company says the targets were US conservative groups.

Larry Loeb, Blogger, Informationweek

August 22, 2018

3 Min Read

Microsoft, riding the latest wave of security theatre, has announced that it has shut down some domains that it asserts were set up by the Strontium group (a confederate of the Russian GRU) so that it could conduct phishing operations.

The domains included close similarities to conservative think tanks, as well as US Senate operations. The pulled domains are my-iri.org, hudsonorg-my-sharepoint.com, senate.group, adfs-senate.services, adfs-senate.email and office365-onedrive.com.

In the announcement, Microsoft said that the Digital Crimes Unit (DCU) carried out a court order to enable this domain transfer and noted that they have used this approach 12 times in the last two years to shut down 84 fake websites associated with this group.

They also say a special master appointed by a federal judge concluded in the recent court order obtained by DCU, saying that there is "good cause" to believe that Strontium is "likely to continue" its conduct. No active phishing attacks were associated with the removed domains.

Nikita Karimov via Unsplash

Nikita Karimov via Unsplash

This action raises a meta-question: Why is Microsoft taking actions affecting national security that involve a court? Is this not something that some governmental entity like the FBI should be involved in rather than a private business?

MSFT has already announced its "Defending Democracy Program" with some fanfare in April. It paints itself as a concerned participant looking to "bring people and expertise together from across governments, political parties, campaigns and the tech sector. While cybersecurity starts with Microsoft and other companies in the tech sector, it's ultimately a shared responsibility with customers and governments around the world."

They seem to want their influence felt around the world. All of it.

Microsoft has a checkered history regarding individual rights. It has long been suspected of having backdoors in its products that could be exploited by authorities. This seeming change to an altruistic view of the political process may leave some unconvinced about Microsoft's true motivation.

But many of the leading tech companies (like Amazon, Apple, Facebook, Microsoft and Twitter) did have a meeting in April with intelligence community representatives about what tech companies could be doing to counter election manipulation. So, it's not just Microsoft involved in this effort.

It is not inconceivable that this latest Microsoft action was done at the behest of the intelligence community, using Microsoft as a cover.

But Microsoft has its own private agenda. The AccountGuard service that it has established as part of the Defending Democracy program will only work with Office 365 users, for example.

They say the AccountGuard service "provides best practices and guidance, and may provide notification of a nation state attack. This service does not make a participant 'hack-proof' -- it is the customer's responsibility to manage security."

Giving service to its users is what any company should do. Yet making pre-emptive judgments about national security situations is beyond its rightful sphere. In this case, the outcome may be beneficial, though normalizing a company's dealing with common threats is a dangerous precedent that may not work out so well the next time it happens.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Read more about:

Security Now

About the Author

Larry Loeb

Blogger, Informationweek

Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. He has written a book on the Secure Electronic Transaction Internet protocol. His latest book has the commercially obligatory title of Hack Proofing XML. He's been online since uucp "bang" addressing (where the world existed relative to !decvax), serving as editor of the Macintosh Exchange on BIX and the VARBusiness Exchange. His first Mac had 128 KB of memory, which was a big step up from his first 1130, which had 4 KB, as did his first 1401. You can e-mail him at [email protected].

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights