US court filing via CourtListener RECAP: Microsoft Corporation v. John Does 1-2
Microsoft civil action to seize Thallium command-and-control domains used for spearphishing and credential theft against government employees, nuclear-proliferation workers, think tanks, universities and human rights organizations · active since 2010 (complaint filed December 2019)
The precise identities and locations of those behind the activity are generally unknown but have been linked by many in the security community to North Korean hacking group or groups. Thallium targets Microsoft customers in both the private and public sectors ... Thallium has targeted government employees, organizations and individuals that work on Nuclear Proliferation issues, think tanks, university staff members, members of organizations that attempt to maintain world peace, human rights organizations, as well as many other organizations and individuals. Thallium has been active since 2010 [Case No. 1:19-cv-01582, U.S. District Court for the Eastern District of Virginia; filing: COMPLAINT against John Does 1-2, filed by Microsoft Corporation.]