Loading story…
Microsoft said it disrupted infrastructure used by the China-based threat group NICKEL after obtaining a federal court order in Virginia to seize malicious domains and redirect them to Microsoft-controlled servers. The company said the domains supported intrusions against organizations in the United States and 28 other countries, with victims including government agencies, ministries of foreign affairs, diplomatic entities, think tanks, and human rights organizations across Latin America and Europe.
According to Microsoft, NICKEL used stealthy malware, stolen spear-phishing credentials, compromised third-party VPN suppliers, and exploits targeting unpatched on-premises Exchange Server and SharePoint systems to conduct intelligence-gathering operations. Court records show Microsoft filed a civil action against unidentified operators controlling the domains and secured emergency relief, including a temporary restraining order, preliminary injunctions, discovery authority, and ultimately a default judgment with a permanent injunction to disable the infrastructure and preserve evidence.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Microsoft announced that its Digital Crimes Unit had disrupted infrastructure used by Nickel and described the group's targeting of government agencies, think tanks, human rights organizations, diplomatic entities, and ministries of foreign affairs in the United States and 28 other countries. Microsoft also said Nickel used stealthy malware, compromised third-party VPN suppliers, stolen spear-phishing credentials, and exploits against unpatched on-premises Exchange and SharePoint systems.
A legal notice for Microsoft's civil case against John Does 1-2 was first published, describing allegations that the defendants controlled domains used in a cybercriminal operation targeting Microsoft and its customers. The notice also outlined requested relief including disabling and preserving the domains.
Microsoft filed pleadings with the U.S. District Court for the Eastern District of Virginia seeking authority to take control of websites allegedly used by Nickel in attacks. The action was part of a civil lawsuit against John Does tied to the malicious domains.
Microsoft said it had analyzed the specific Nickel activity described in the reports since 2019. The campaign targeted organizations for intelligence gathering across multiple regions.
Microsoft said its Threat Intelligence Center had tracked the China-linked threat group Nickel since 2016. The group is also referred to by other researchers as KE3CHANG, APT15, Vixen Panda, Royal APT, and Playful Dragon.
After obtaining court authority, Microsoft redirected traffic from the malicious websites to Microsoft-controlled secure servers. Microsoft said this both protected victims and gave it additional visibility into Nickel's operations.
A federal court in Virginia granted Microsoft's request to seize malicious websites used by Nickel, later unsealing the order after service on hosting providers was completed. Microsoft said the action cut off Nickel's access to victims and prevented the sites from being used in further attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourceblogs.microsoft.com
Open sourcenoticeofpleadings.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Justice Department and Microsoft disrupted infrastructure used by **Star Blizzard**, a Russia-linked threat group tied to the FSB, by seizing more than 100 internet domains used in spear-phishing and credential-theft operations. Federal investigators obtained a warrant for **41 domains**, while Microsoft secured a civil court order covering **66 more**, targeting infrastructure allegedly operated by the group also known as **Callisto Group**, **COLDRIVER**, and **SEABORGIUM**. Authorities said the domains were used to impersonate trusted contacts and lure victims into surrendering credentials or granting access to email accounts and computers. U.S. officials said the campaign targeted government personnel, former intelligence officials, Department of Defense and State employees, defense contractors, Department of Energy staff, journalists, think tanks, NGOs, and other civil society organizations. The Justice Department said the operation sought sensitive information related to U.S. defense, foreign affairs, and nuclear energy research, while Microsoft reported that Star Blizzard had targeted at least **82 customers** and more than **30 civil society organizations** since 2023, at a pace of roughly one attack per week. The disruption was presented as part of a broader effort to blunt Russian intelligence collection and reduce the risk of interference affecting democratic institutions and public-interest groups.
Jun 29, 2026
Microsoft and U.S. authorities said **Nobelium**, the Russia-linked espionage group associated with the SolarWinds intrusion, used a compromised USAID account at a mass email marketing provider to send phishing emails masquerading as **USAID** alerts. The campaign began around May 25 and targeted thousands of accounts across more than 100 organizations, with reporting indicating the activity reached civil society, diplomatic, election-related, and human-rights groups in at least 24 countries. Identified targets included anti-corruption activists in Ukraine, an employee of the **OSCE**, **EU DisinfoLab**, and former U.S. ambassador to Russia Alexander Vershbow. According to the Justice Department, victims who clicked the malicious link were directed to malware hosted on a subdomain of `theyardservice[.]com`, after which the attackers deployed **Cobalt Strike** for persistence and potential follow-on operations. The DOJ obtained court-authorized seizures of `theyardservice[.]com` and `worldhomeoutlet[.]com`, describing them as infrastructure used for malware delivery and command-and-control, while Microsoft and DHS said they had not yet observed large-scale compromise. U.S. officials said the disruption was intended to cut off the phishing operation and help identify victims, while cautioning that some organizations may already have been backdoored.
Aug 14, 2026
Microsoft said the China-aligned espionage group **Storm-0558** stole a Microsoft consumer signing key and used it to forge authentication tokens that granted unauthorized access to **Exchange Online** and **Outlook.com** mailboxes. The company said the activity began in May and affected email accounts at **25 organizations** as well as related consumer accounts, prompting mitigation and a broader investigation into how the actor obtained and abused the key to access cloud-hosted email. Subsequent analysis indicated the impact may have extended beyond email. Researchers reported the compromised key could potentially authenticate access to additional Microsoft services, including **Azure Active Directory**, **SharePoint**, **Teams**, and **OneDrive**, as well as some customer-managed applications relying on Microsoft authentication. SecurityScorecard later identified **10 IP addresses** in NetFlow data that may have served as attacker proxies linked to the campaign, and said the traffic suggested possible targeting of Microsoft and a Western European government ministry, although the full victim scope remained unconfirmed.
Aug 21, 2026