Bold action against fraud: Disrupting Storm-1152

In February 2023, Matthew Mesa, Senior Security Researcher in Microsoft’s Threat Intelligence Center (MSTIC), observed a growing pattern of Microsoft Outlook accounts being used in mass phishing campaigns. In his role, Mesa analyzes email campaigns, and looks for suspicious activity. As he continued to see a rise in the use of fraudulent accounts, he asked himself: “could all these accounts be related to one another?”

He immediately created a new threat actor profile, Storm-1152, and started to track its activity and flagged his findings to Microsoft’s Identity team. Shinesa Cambric, Principal Product Manager of Microsoft’s Anti-Abuse and Fraud Defense Team had also been tracking this malicious activity and had noticed an increase of automated accounts (bots) attempting to defeat the CAPTCHA challenges used to protect the sign-up process for Microsoft consumer services.​​

“My team focuses both on our consumer experience as well as our enterprise experience, which means we're protecting billions of accounts every day from fraud and abuse,” Cambric explains. “Our role is to understand the threat actor methodologies so we can circumvent attacks and prevent access into our systems. We’re always thinking about prevention—about how we can stop bad actors at the front door.”

What got her attention was the growing level of fraud related to the activity. When multiple parties—Microsoft partners as well as parts of our supply chain—reached out to report the harm resulting from these bot-created Microsoft accounts, Cambric went into action.

Together with cybersecurity defense and bot management provider Arkose Labs, Cambric’s team worked to identify and disable the group’s fraudulent accounts, and shared details of their work with threat intelligence colleagues in Microsoft’s MSTIC and the Arkose Cyber Threat Intelligence Research unit (ACTIR).

“Initially, our role was to protect Microsoft from malicious account creation,” Arkose Labs Chief Customer Officer Patrice Boffa explains, “But once Storm-1152 was identified as a group, we also began collecting a lot of the threat intelligence.”

When the fraudulent activity reached a boiling point in March 2023, Cambric and Mesa engaged Microsoft’s Digital Crimes Unit (DCU) to see what more could be done.

As Microsoft’s external enforcement arm, DCU typically pursues only the most serious or persistent actors. It focuses on disruption—raising the cost of doing business—for which criminal referrals and/or civil lawsuits are primary tools.

Sean Farrell, Lead Counsel for the Cybercrime Enforcement team in Microsoft’s DCU, Jason Lyons, Principal Manager of Investigations in the DCU Cybercrime Enforcement Team at Microsoft and Senior Cyber Investigator Maurice Mason got together to investigate further. They coordinated with Microsoft’s outside counsel to design a legal strategy and pulled together the evidence required to file a civil action, drawing insights from multiple teams across Microsoft and the threat intelligence Arkose Labs was collecting.

“A lot of work had already been done by the time the DCU got involved,” Lyons recalls. “The Identity team and Arkose Labs had already done significant work in identifying and disabling accounts, and because MSTIC was able to link the fraudulent accounts to certain levels of infrastructure, we thought this would be a good DCU legal case.”

Some of the factors that contribute to the formation of a case worth pursuing include having laws that can be used in a civil action, having jurisdiction, and the willingness of the company to publicly name individuals.

Lyons likened the consideration of these factors to a triage process, where DCU examined the facts and information to help it determine whether everything made a good case. “Based on what we do, we ask whether we want to spend our time and energy to take action,” he says. “Will the impact be worth the resources we have to put in there?” The answer in this case was yes.

Mason was tasked with working on the attribution of Storm-1152’s cybercrime-as-a-service activities. “My role was to track how Storm-1152 sold these fraudulent accounts to other threat actor groups and identify the individuals behind Storm-1152,” Mason explains.

Through their investigative work, which included a deep review of social media pages and payment identifiers, Microsoft and Arkose Labs were able to identify the individuals behind Storm-1152 —Duong Dinh Tu, Linh Van Nguyễn (also known as Nguyễn Van Linh), and Tai Van Nguyen.

Their findings show these individuals operated and wrote the code for the illicit websites, published detailed step-by-step instructions on how to use their products via video tutorials, and provided chat services to assist those using their fraudulent services. Additional connections were then made to the group’s technical infrastructure, which the team was able to pinpoint to US-based hosts.

Describing the decision to move forward with the case, Farrell says, “Here we were fortunate because of the great work of the teams, which had identified the actors who had set up the infrastructure and the criminal services.

One of the reasons we pursue these actions in DCU is to deter the impact of these cybercriminals. We do this by filing lawsuits or from providing criminal referrals that lead to arrests and prosecutions. I think it sends a very strong message when you're able to identify the actors and publicly identify them in legal pleadings in the United States.”​​​

Reflecting on the outcome of the Storm-1152 investigation and disruption, Farrell notes that the case is important not just because of its impact to us and the other companies affected, but because of Microsoft’s effort to scale the impact of these operations, which are a part of the overall cybercrime-as-a-service ecosystem.