Lex Digitales Мониторинг трендов регулирования цифровой экономики

← к документу

Что изменилось

Microsoft Corporation v. John Does 1-2 · редакция 1 → 2 · зафиксировано 2026-09-17 03:36 · +16 −16 строк

## UNITED STATES DISTRICT COURT
## MEMORANDUM OPINION
## GRANTING MICROSOFT &NGO-ISAC’S MOTION FOR DEFAULT JUDGMENT AND PERMANENT
## GRANTING MICROSOFT & NGO-ISAC’S MOTION FOR DEFAULT JUDGMENT AND PERMANENT
INJUNCTION
## A. Relevant Facts
Plaintiffs allege that Defendants are the masterminds of “an ongoing internet-based spear phishing operation known as ‘Star Blizzard.’” Compl. at 1. According to Plaintiffs, Defendants begin their attacks by scouring “public facing sources of intelligence,” including social media, to identify targets. Seeid. ¶ 22. Next, Defendants will “open a new email account,” which they design “to match or look similar to legitimate addresses and account names.” Seeid. ¶ 24. For example, Defendants have “impersonate[d] NGO-ISAC member Carnegie Corporation of New
York . . . in [their] spear phishing emails.” The Defendants then use the email account to contact their target. Seeid. ¶ 25. Their communications “begin[] with rapport building and then escalate[] to the sending of a fictitious attachment.” Id. ¶ 26. At this point, “Defendants attach a file or include[] a link to a file share platform like OneDrive.” Id. To effectuate their attacks,
Defendants control hundreds of internet domains. Seeid. ¶ 20. When targets click on links sent to them by the Defendants, they are directed to one of those domains. See id. ¶ 35. The domains appear as though they were the login page for a Microsoft service. See id. ¶ 36. As an example, the spoofed login pages will often include the “language ‘©Microsoft 2016’” to convince the target that “the link is to a legitimate Microsoft webpage.” See id. ¶ 45. More generally,
Defendants use “Microsoft brands and trademarks . . . to confuse Microsoft’s customers into clicking on malicious links that they believe are associated with and owned by Microsoft.” See id. ¶ 46. “Once a victim inputs their login credentials, Star Blizzard is able to capture the credential.” Id. ¶ 39. The Defendants then use the captured credentials to gain access to the target’s email account. Seeid. Once in possession of the target’s login credentials, “[t]he final step of Star Blizzard’s attack sequence is data exfiltration.” Id. ¶ 41. Defendants have used their newfound access to target’s emails to set up rules “that would automatically forward an email received by the victim to another email address,” and have extracted “mailing lists and other contact information,” which aid Defendants in other attacks. Seeid. In response to these attacks,
Plaintiffs allege that Defendants are the masterminds of “an ongoing internet-based spear phishing operation known as ‘Star Blizzard.’” Compl. at 1. According to Plaintiffs, Defendants begin their attacks by scouring “public facing sources of intelligence,” including social media, to identify targets. See id. ¶ 22. Next, Defendants will “open a new email account,” which they design “to match or look similar to legitimate addresses and account names.” See id. ¶ 24. For example, Defendants have “impersonate[d] NGO-ISAC member Carnegie Corporation of New
York . . . in [their] spear phishing emails.” The Defendants then use the email account to contact their target. See id. ¶ 25. Their communications “begin[] with rapport building and then escalate[] to the sending of a fictitious attachment.” Id. ¶ 26. At this point, “Defendants attach a file or include[] a link to a file share platform like OneDrive.” Id. To effectuate their attacks,
Defendants control hundreds of internet domains. See id. ¶ 20. When targets click on links sent to them by the Defendants, they are directed to one of those domains. See id. ¶ 35. The domains appear as though they were the login page for a Microsoft service. See id. ¶ 36. As an example, the spoofed login pages will often include the “language ‘©Microsoft 2016’” to convince the target that “the link is to a legitimate Microsoft webpage.” See id. ¶ 45. More generally,
Defendants use “Microsoft brands and trademarks . . . to confuse Microsoft’s customers into clicking on malicious links that they believe are associated with and owned by Microsoft.” See id. ¶ 46. “Once a victim inputs their login credentials, Star Blizzard is able to capture the credential.” Id. ¶ 39. The Defendants then use the captured credentials to gain access to the target’s email account. See id. Once in possession of the target’s login credentials, “[t]he final step of Star Blizzard’s attack sequence is data exfiltration.” Id. ¶ 41. Defendants have used their newfound access to target’s emails to set up rules “that would automatically forward an email received by the victim to another email address,” and have extracted “mailing lists and other contact information,” which aid Defendants in other attacks. See id. In response to these attacks,
Microsoft has “expended more than $1,000,000” to investigate the harms resulting from these attacks, and Carnegie Corporation of New York, a member of NGO-ISAC, has similarly expended “approximately $200,000.” Id. ¶ 48.
## B. Procedural History
On September 24, 2024, Plaintiffs filed their complaint. Seegenerally Compl. At the same time, Plaintiffs moved for a temporary restraining order (“TRO”) and a preliminary injunction transferring ownership of Star Blizzard-controlled domains to Plaintiffs, which this
On September 24, 2024, Plaintiffs filed their complaint. See generally Compl. At the same time, Plaintiffs moved for a temporary restraining order (“TRO”) and a preliminary injunction transferring ownership of Star Blizzard-controlled domains to Plaintiffs, which this
Court granted on September 25, 2024.1 Subsequently, this Court granted requests for several supplemental preliminary injunctions. See Dkt. No. 22; Dkt. No. 28; Dkt. No. 41.
P. 55. Rule 55(a) permits the entry of default by the clerk when “a party against whom a judgment for affirmative relief is sought has failed to plead or otherwise defend, and that failure is shown by affidavit or otherwise.” Id. Once the clerk enters the default under Rule 55(a), the
Plaintiff must “apply to the court for a default judgment” under Rule 55(b)(2).2Id.
Plaintiff must “apply to the court for a default judgment” under Rule 55(b)(2).2 Id.
After an entry of default, the “defaulting defendant is deemed to admit every wellpleaded allegation in the complaint.” AARP v. Sycle, 991 F. Supp. 2d 234, 238 (D.D.C. 2014)
Computer Fraud and Abuse Act, and the Electronic Communications Privacy Act. See Compl.
¶¶ 54–90. As this Court found when it issued the TRO, there is subject matter jurisdiction over those claims. See 28 U.S.C. § 1331 (“The district courts shall have original jurisdiction of all civil actions arising under the Constitution, laws, or treaties of the United States.”);Ex Parte
¶¶ 54–90. As this Court found when it issued the TRO, there is subject matter jurisdiction over those claims. See 28 U.S.C. § 1331 (“The district courts shall have original jurisdiction of all civil actions arising under the Constitution, laws, or treaties of the United States.”); Ex Parte
TRO and O.S.C. Re Prelim. Inj. ¶ 1, ECF No. 12. Additionally, this Court has supplemental jurisdiction over Plaintiff’s common law trespass to chattels, conversion, and unjust enrichment claims. See 28 U.S.C. § 1367 (“[I]n any civil action of which the district courts have original jurisdiction, the district courts shall have supplemental jurisdiction over all other claims that are so related to claims in the action within such original jurisdiction that they form part of the same case or controversy.”).
## B. Service of Process
“Before a federal court may exercise personal jurisdiction over a defendant, the procedural requirement of service of summons must be satisfied.”Mwani v. bin Laden, 417 F.3d
“Before a federal court may exercise personal jurisdiction over a defendant, the procedural requirement of service of summons must be satisfied.” Mwani v. bin Laden, 417 F.3d
1, 8 (D.C. Cir. 2005) (quoting Omni Cap. Int’l, Ltd. v. Rudolf Wolff & Co., 484 U.S. 97, 104 (1987)). Additionally, to satisfy due process, the method of service must be “reasonably calculated, under all the circumstances, to apprise interested parties of the pendency of the action and afford them an opportunity to present their objections.” Mullane v. Central Hanover Bank &
Parte TRO and O.S.C. RE Prelim. Inj. at 10–11. Plaintiffs aver that they “served email addresses associated with the Defendants’ Internet domains” on October 3, 2024. Pls.’ Br. at 3. And the “emails were repeatedly opened and viewed by Defendants between October 3, 2024 and the present.” Id. Additionally, Plaintiffs served Defendants by publication beginning on October 3,
2024.3See id.
2024.3 See id.
Despite online publication and emailed notice, Defendants ignored this lawsuit. The combination of service by email and by publication does not violate any international agreement and is reasonably calculated to achieve notice to the Defendants.4 Accordingly, the Court concludes that service by email and publication was sufficient.
As noted above, before entering a default judgment, the Court must evaluate Plaintiffs’ complaint to be sure that it sufficiently states a claim for which relief can be granted. See
Gutierrez,2000 WL 331721, at *2.
Gutierrez, 2000 WL 331721, at *2.
## D. Lanham Act Claims
At the default judgment stage, Defendants have conceded that Microsoft and NGO-ISAC member organization Carnegie Corporation of New York’s trademarks are valid and that they have distinctive or secondary meaning. Microsoft and NGO-ISAC have also provided their federal trademark registrations in their complaint. See Compl. Apps. B & C. Plaintiffs have alleged that, as part of their scheme, Defendants present targets with “a webpage that appears to be a Microsoft login page,” and that they use “Microsoft brands and trademarks . . . to confuse
Microsoft’s customers into clicking on Malicious links that they believe are associated with and owned by Microsoft.” Compl. ¶ 45. As an example, Plaintiffs provide an image, seeid. fig. 10, of a “cloned phishing portal used by the . . . Defendants to directly impersonate [Microsoft].” Id.
Microsoft’s customers into clicking on Malicious links that they believe are associated with and owned by Microsoft.” Compl. ¶ 45. As an example, Plaintiffs provide an image, see id. fig. 10, of a “cloned phishing portal used by the . . . Defendants to directly impersonate [Microsoft].” Id.
¶ 37. The clear purpose and effect, when successful, in using Plaintiffs’ trademarks is to confuse targets into thinking that Defendants’ domains are actually controlled by the owners of the trademarks to induce targets to provide the sought after credentials or information. Additionally,
As discussed above, Plaintiffs have succeeded by default on the merits of the action.
Plaintiffs further argue that they have suffered irreparable injury owing to the “[c]onsumer confusion and injury to business goodwill” that is likely to occur if “Defendants are able to continue to use domains bearing Plaintiffs’ trademarks and brands in furtherance of their activities.” Pls.’ Br. at 22. This Court has previously found that, absent an injunction, “irreparable harm will occur to Microsoft, Microsoft’s customer, NGO-ISAC, NGO-ISAC’s customers, and the public.” Order Granting Mot. for Prelim. Inj. ¶ 8, ECF No. 12. Additionally, with respect to Plaintiffs’ Lanham Act claims, “trademark infringement, by its very nature, carries a presumption of harm.” SeeHanley-Wood LLC v. Hanley Wood LLC, 783 F. Supp. 2d
Plaintiffs further argue that they have suffered irreparable injury owing to the “[c]onsumer confusion and injury to business goodwill” that is likely to occur if “Defendants are able to continue to use domains bearing Plaintiffs’ trademarks and brands in furtherance of their activities.” Pls.’ Br. at 22. This Court has previously found that, absent an injunction, “irreparable harm will occur to Microsoft, Microsoft’s customer, NGO-ISAC, NGO-ISAC’s customers, and the public.” Order Granting Mot. for Prelim. Inj. ¶ 8, ECF No. 12. Additionally, with respect to Plaintiffs’ Lanham Act claims, “trademark infringement, by its very nature, carries a presumption of harm.” See Hanley-Wood LLC v. Hanley Wood LLC, 783 F. Supp. 2d
147, 151 (D.D.C. 2011). Thus, there is ample reason to believe that Plaintiffs will suffer irreparable injury absent a permanent injunction. Lastly, the Court finds that an injunction would not harm Defendants or other interested parties, and that the public interest favors both “protecting against further violation of federal copyright and trademark laws,” Hanley-Wood
United States District Judge