The web domain seizure enforcement action aims to clamp down on the group’s latest campaign.
Compromised account
On or around May 25, malicious parties abused a compromised USAID account at a legitimate mass mailing service to launch a spear-phishing campaign sent to “thousands of email accounts at over one hundred entities”.
These malicious messages purported to contain a “special alert” from USAID which was designed to trick prospective victims into clicking on a link and visiting a malicious site loaded with malware.
“The seizure of the two domains was aimed at disrupting the malicious actors’ follow-on exploitation of victims, as well as identifying compromised victims,” according to a US Department of Justice statement on the case.