Microsoft this month took down a cybercrime ring that it says created and sold approximately 750 million fake Microsoft accounts.The group, which Microsoft is calling Storm-1152, “runs illicit websites and social media pages, selling fraudulent Microsoft accounts and tools to bypass identity verification software across well-known technology platforms.”As Microsoft explains, the fake accounts created by Storm-1152 are needed to keep the scam going. “With companies able to quickly identify and shut down fraudulent accounts, criminals require a greater quantity of accounts to circumvent mitigation efforts Instead of spending time trying to create thousands of fraudulent accounts, cybercriminals can simply purchase them from Storm-1152 and other groups.”With these accounts at their disposal, criminals can “focus their efforts on their ultimate goals of phishing, spamming, ransomware, and other types of fraud and abuse,” Microsoft says.Among the groups that have worked with Storm-1152 is Scattered Spider, which was reportedly behind the recent hack of MGM Resorts.Microsoft worked with Arkose Labs on the Storm-1152 investigation, and on Dec. 7, it got a court order from the Southern District of New York to seize US-based infrastructure and take down websites used by Storm-1152.According to Arkose founder and CEO Kevin Gosschalk Storm-1152 “is distinguished by the fact that it built its CaaS [cybercrime-as-a-service] business in the light of day versus on the dark web, [operating] as a typical internet going-concern, providing training for its tools and even offering full customer support. In reality, Storm-1152 was an unlocked gateway to serious fraud.”
Read the original article here.
