Loading story…
The Brazilian hacker group Prime Suspectz defaced multiple Microsoft-related websites, altering pages for Microsoft operations in the U.K., Mexico, and Saudi Arabia and also hitting the MSNBC Sports Scoreboard site. The attackers replaced normal content with taunting messages, and in the MSNBC case displayed a nuclear explosion image, the group’s logo, and a message in Portuguese. Microsoft and MSNBC said the affected systems were restored quickly after discovery, with MSNBC taking impacted Scoreboard servers offline before returning them to service later the same day.
Microsoft said the compromised subsidiary sites were in some cases operated by third parties, were not connected to the Redmond corporate network, and did not expose consumer or sensitive company data. The incident was reported as at least the ninth known defacement of a Microsoft website tracked by Attrition.org and followed earlier compromises involving Microsoft sites in Brazil, Slovenia, Redmond, and New Zealand. The intrusion method remained under investigation, but the attacks intensified scrutiny of Microsoft’s web security amid broader concern over a serious flaw affecting Windows 2000 Server running IIS 5.0.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Microsoft said the defaced subsidiary sites were restored quickly, that some were operated by third parties, and that they were not connected to the Redmond corporate network. The company also said no consumer data was compromised.
After discovering the defacement on Friday morning, MSNBC took the compromised Scoreboard servers offline and restored them by about 11 a.m. PDT. The company said the impacted systems were separate from the main MSNBC site.
Around the same time, Prime Suspectz also defaced the MSNBC Sports Scoreboard site, displaying a nuclear explosion image, the group's logo, and a Portuguese message. MSNBC said the affected servers were operated by a third party and that the main MSNBC site was not affected.
In early May 2001, Prime Suspectz briefly defaced three Microsoft country websites serving the United Kingdom, Mexico, and Saudi Arabia, replacing normal pages with taunting messages. Microsoft said the sites were restored quickly and that no consumer or sensitive data was exposed.
After Microsoft disclosed a serious Windows 2000 IIS vulnerability in the Internet Printing component, exploit template code was published by a hacker known as dark spyrit. The flaw, discovered by eEye Digital Security, could allow remote takeover of vulnerable web servers and raised concern that exploitation would become easier.
CNN's report notes that the Brazilian hacker group Prime Suspectz had previously targeted Microsoft by compromising the Microsoft New Zealand website in January 2001.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cnet.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Justice Department and Microsoft disrupted infrastructure used by **Star Blizzard**, a Russia-linked threat group tied to the FSB, by seizing more than 100 internet domains used in spear-phishing and credential-theft operations. Federal investigators obtained a warrant for **41 domains**, while Microsoft secured a civil court order covering **66 more**, targeting infrastructure allegedly operated by the group also known as **Callisto Group**, **COLDRIVER**, and **SEABORGIUM**. Authorities said the domains were used to impersonate trusted contacts and lure victims into surrendering credentials or granting access to email accounts and computers. U.S. officials said the campaign targeted government personnel, former intelligence officials, Department of Defense and State employees, defense contractors, Department of Energy staff, journalists, think tanks, NGOs, and other civil society organizations. The Justice Department said the operation sought sensitive information related to U.S. defense, foreign affairs, and nuclear energy research, while Microsoft reported that Star Blizzard had targeted at least **82 customers** and more than **30 civil society organizations** since 2023, at a pace of roughly one attack per week. The disruption was presented as part of a broader effort to blunt Russian intelligence collection and reduce the risk of interference affecting democratic institutions and public-interest groups.
Jun 29, 2026
Black Basta affiliates used a multi-stage social-engineering campaign to breach corporate networks by impersonating IT support staff in **Microsoft Teams** and persuading employees to grant remote access through **Windows Quick Assist** and **AnyDesk**. Researchers said the attacks often began with email bombing to overwhelm targets, followed by Teams chats or calls from attacker-controlled external Entra ID tenants using names such as "Help Desk" or "support." In earlier incidents, the group similarly abused Quick Assist after contacting victims by phone, showing a consistent pattern of using legitimate remote-support tools to gain initial access. After access was established, the attackers deployed additional tooling including **ScreenConnect**, **NetSupport Manager**, **Cobalt Strike**, and **SystemBC**-linked payloads, while also using credential-theft and lateral-movement activity such as accessing **LSASS**, scanning internal hosts, and running **Impacket `secretsdump.py`**. ReliaQuest also observed malicious QR-code lures tied to domains such as `qr-s1[.]com` through `qr-s4[.]com`, and a VBS-based infection chain that contacted `179.60.149[.]194` to retrieve follow-on payloads. The activity was attributed to Black Basta with high confidence, with reporting indicating infrastructure and Teams activity linked to Russia, and defenders were urged to restrict external Teams communications, limit trusted domains, and improve Teams, email, and remote-access monitoring.
Aug 14, 2026
Attackers targeted externally exposed, unpatched **Microsoft SQL Server** systems by exploiting `CVE-2019-1068` and `CVE-2020-0618`, then delivered a mix of malware and ransomware through shared infrastructure and tooling. Sophos linked the intrusions through common ingress methods, command-and-control servers, PowerShell downloaders, a **.NET downloader**, **Remcos RAT**, the **Kill$** cleaner, and **7zip SFX**-based loaders, with ransomware payloads including **TargetCompany/Mallox** and **GlobeImposter/Alpha865qqz**. Most victims were observed in Asia, with additional cases in the Americas, and Chinese-language comments in some tools suggested the operators may be based in Asia. In one investigated case, the attackers returned after an earlier ransomware incident because the SQL Server remained unpatched, showing how exposed systems can be repeatedly compromised until the root weakness is fixed. Sophos said its defenses blocked follow-on payload delivery and prevented lateral movement, data exfiltration, and further ransom escalation, while responders also identified **IOBit Unlocker** as an attempted anti-security utility. Continued traffic to a fake **KMSAuto**-themed download site helped tie the customer incident to the wider campaign.
Aug 15, 2026