ALEXANDRIA, Va. – On May 28, 2021, pursuant to court orders issued in the Eastern District of Virginia, the United States seized two command-and-control (C2) and malware distribution domains used in recent spear-phishing activity that mimicked email communications from the U.S. Agency for International Development (USAID). This malicious activity was the subject of a May 27, 2021 Microsoft security alert, titled “New sophisticated email-based attack from Nobelium,” in which Microsoft attributed the activity to a nation-state group.
The Department’s seizure of the two domains was aimed at disrupting the malicious actors’ follow-on exploitation of victims, as well as identifying compromised victims. However, the actors may have deployed additional backdoor accesses between the time of the initial compromises and the seizures.
“Cyber intrusions and spear-phishing email attacks can cause widespread damage throughout affected computer networks, and can result in significant harm to individual victims, government agencies, NGOs, and private businesses,” said Acting U.S. Attorney Raj Parekh for the Eastern District of Virginia. “As demonstrated by the court-authorized seizure of these malicious domains, we are committed to using all available tools to protect the public and our government from these worldwide hacking threats.”
“Last week’s action is a continued demonstration of the Department’s commitment to proactively disrupt hacking activity prior to the conclusion of a criminal investigation,” said Assistant Attorney General John C. Demers for the Justice Department’s National Security Division. “Law enforcement remains an integral part of the U.S. government’s broader disruption efforts against malicious cyber-enabled activities, even prior to arrest, and we will continue to evaluate all possible opportunities to use our unique authorities to act against such threats.”
“The FBI remains committed to disrupting this type of malicious cyber activity targeting our federal agencies and the American public,” said Assistant Director Bryan Vorndran of the FBI’s Cyber Division. “We will continue to use all of the tools in our toolbelt and leverage our domestic and international partnerships to not only disrupt this type of hacking activity but to impose risk and consequences upon our adversaries to combat these threats.”
“Friday’s court-authorized domain seizures reflect the FBI Washington Field Office’s continued commitment to cyber victims in our region,” said Assistant Director in Charge Steven M. D’Antuono of the FBI’s Washington Field Office. “These actions demonstrate our ability to quickly respond to malicious cyber activities by leveraging our unique authorities to disrupt our cyber adversaries.”
As described in the seizure documents, on or about May 25, 2021, malicious actors commenced a wide-scale spear-phishing campaign leveraging a compromised USAID account at an identified mass email marketing company. Specifically, the compromised account was used to send spear-phishing emails, purporting to be from USAID email accounts and containing a “special alert,” to thousands of email accounts at over one hundred entities
Upon a recipient clicking on a spear-phishing email’s hyperlink, according to the court documents, the victim computer was directed to download malware from a sub-domain of theyardservice[.]com. Using that initial foothold, the actors then downloaded the Cobalt Strike tool to maintain persistent presence and possibly deploy additional tools or malware to the victim’s network. The actors’ instance of the Cobalt Strike tool received C2 communications via other subdomains of theyardservice[.]com, as well as the domain worldhomeoutlet[.]com. It was those two domains that the Department seized pursuant to the court’s seizure orders.
The United States Attorney’s Office for the Eastern District of Virginia and the National Security Division’s Counterintelligence and Export Control Section are investigating this matter in coordination with the FBI’s Cyber Division and Washington Field Office.
Raj Parekh, Acting U.S. Attorney for the Eastern District of Virginia; John C. Demers, Assistant Attorney General for National Security; Bryan Vorndran, Assistant Director of the FBI’s Cyber Division; and Steven M. D’Antuono, Assistant Director in Charge of the FBI’s Washington Field Office, made the announcement.
A copy of this press release is located on the website of the U.S. Attorney’s Office for the Eastern District of Virginia. Related court documents and information are located on the website of the District Court for the Eastern District of Virginia.
NICS Inquiries/Firearms Records Checks
Send to USAVAE.NICS@usdoj.gov
Protect yourself from fraud, and report suspected cases of financial fraud to local law enforcement.
Victim Witness Case
Updates
U.S. V. KRISTOPHER LEE DALLMANN ET AL
Megaupload – Release For Victim Notification
Talk to your kids about gangs and how to avoid them.
Help us combat the proliferation of sexual exploitation crimes against children.