UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
Microsoft Corporation, a Washington State
Corporation, NGO-ISAC, a New York State
Non-Profit Organization, :
:
Plaintiffs, : Civil Action No.: 24-2719 (RC)
:
v. : Re Document No.: 45
:
John Does 1-2, Controlling A Computer
Network and Thereby Injuring Plaintiff and Its
Customers. :
:
Defendants. :
MEMORANDUM OPINION
GRANTING MICROSOFT & NGO-ISAC’S MOTION FOR DEFAULT JUDGMENT AND PERMANENT
INJUNCTION
I. INTRODUCTION
This matter comes before the Court on Plaintiffs’ motion for a default judgment and
permanent injunction. Plaintiffs, Microsoft Corporation (“Microsoft”) and NGO Information
Sharing and Analysis Center (“NGO-ISAC”), bring claims under the Computer Fraud and Abuse
Act (“CFAA”), Electronic Communications Privacy Act (“ECPA”), the Lanham Act, and the
common law doctrines of trespass to chattels, conversion, and unjust enrichment. Plaintiffs
allege that Defendants, whom they characterize as “Russia-based cybercriminals,” operate “an
ongoing internet-based spear phishing operation known as ‘Star Blizzard.’” Compl. ¶¶ 1, 17.
“Spear phishing is a type of personalized attack in which the cybercriminal attempts to acquire
sensitive information or access a computer by sending a fake email message that appears to be
legitimate,” which tricks the target into clicking on a malicious link, attachment, or providing confidential information or credentials. Id. ¶ 19. The scheme is allegedly directed at Microsoft
and its customers, NGO-ISAC’s member organizations, and the general public. Id. During the
pendency of this litigation, Defendants have not appeared or responded in any manner, and
“[d]efendants’ true identities remain unknown despite extensive discovery efforts.” Decl. of
Anna Z. Saber ¶ 26. Upon review of the record and all relevant documents, this Court grants
Plaintiffs’ motion.
II. FACTUAL BACKGROUND
A. Relevant Facts
Plaintiffs allege that Defendants are the masterminds of “an ongoing internet-based spear
phishing operation known as ‘Star Blizzard.’” Compl. at 1. According to Plaintiffs, Defendants
begin their attacks by scouring “public facing sources of intelligence,” including social media, to
identify targets. See id. ¶ 22. Next, Defendants will “open a new email account,” which they
design “to match or look similar to legitimate addresses and account names.” See id. ¶ 24. For
example, Defendants have “impersonate[d] NGO-ISAC member Carnegie Corporation of New
York . . . in [their] spear phishing emails.” The Defendants then use the email account to contact
their target. See id. ¶ 25. Their communications “begin[] with rapport building and then
escalate[] to the sending of a fictitious attachment.” Id. ¶ 26. At this point, “Defendants attach a
file or include[] a link to a file share platform like OneDrive.” Id. To effectuate their attacks,
Defendants control hundreds of internet domains. See id. ¶ 20. When targets click on links sent
to them by the Defendants, they are directed to one of those domains. See id. ¶ 35. The domains
appear as though they were the login page for a Microsoft service. See id. ¶ 36. As an example,
the spoofed login pages will often include the “language ‘©Microsoft 2016’” to convince the
target that “the link is to a legitimate Microsoft webpage.” See id. ¶ 45. More generally,
2
Defendants use “Microsoft brands and trademarks . . . to confuse Microsoft’s customers into
clicking on malicious links that they believe are associated with and owned by Microsoft.” See
id. ¶ 46. “Once a victim inputs their login credentials, Star Blizzard is able to capture the
credential.” Id. ¶ 39. The Defendants then use the captured credentials to gain access to the
target’s email account. See id. Once in possession of the target’s login credentials, “[t]he final
step of Star Blizzard’s attack sequence is data exfiltration.” Id. ¶ 41. Defendants have used their
newfound access to target’s emails to set up rules “that would automatically forward an email
received by the victim to another email address,” and have extracted “mailing lists and other
contact information,” which aid Defendants in other attacks. See id. In response to these attacks,
Microsoft has “expended more than $1,000,000” to investigate the harms resulting from these
attacks, and Carnegie Corporation of New York, a member of NGO-ISAC, has similarly
expended “approximately $200,000.” Id. ¶ 48.
B. Procedural History
On September 24, 2024, Plaintiffs filed their complaint. See generally Compl. At the
same time, Plaintiffs moved for a temporary restraining order (“TRO”) and a preliminary
injunction transferring ownership of Star Blizzard-controlled domains to Plaintiffs, which this
Court granted on September 25, 2024.1 Subsequently, this Court granted requests for several
supplemental preliminary injunctions. See Dkt. No. 22; Dkt. No. 28; Dkt. No. 41.
1
The purpose of transferring domains controlled by Defendants to Microsoft is so that “any time a user clicks on a link in a spear phishing email and provides their username and password, that information will be prevented from going to the Defendants at the Star Blizzardcontrolled domains, because those domains will be hosted on a Microsoft-controlled, secure server, beyond the control of the Star Blizzard Defendants.” Decl. of Sean Ensz ¶ 55, ECF No. 4-2.
3
Defendants have not responded to the litigation in any capacity since Plaintiffs first
served Defendants on October 3, 2024. See Pls.’ Br. Supp. Default J. and Permanent Inj. (“Pls.’
Br.”) at 3, ECF No. 45-2. Accordingly, on February 25, 2026, Plaintiffs moved for an entry of
default under Rule 55. See Dkt. No. 43. The Clerk entered default on February 27, 2026. See
Dkt. No. 44. Plaintiffs then moved for default judgment and a permanent injunction on March
27, 2026. See Dkt. No. 45.
III. LEGAL STANDARD
Federal Rule of Civil Procedure 55 governs the default judgment procedure. Fed. R. Civ.
P. 55. Rule 55(a) permits the entry of default by the clerk when “a party against whom a
judgment for affirmative relief is sought has failed to plead or otherwise defend, and that failure
is shown by affidavit or otherwise.” Id. Once the clerk enters the default under Rule 55(a), the
Plaintiff must “apply to the court for a default judgment” under Rule 55(b)(2).2 Id.
After an entry of default, the “defaulting defendant is deemed to admit every wellpleaded allegation in the complaint.” AARP v. Sycle, 991 F. Supp. 2d 234, 238 (D.D.C. 2014)
(quoting Int’l Painters & Allied Trades Indus. Pension Fund v. R.W. Amrine Drywall Co., Inc.,
239 F. Supp. 2d 26, 30 (D.D.C. 2002)). That being said, “the determination of whether default
judgment is proper is committed to the discretion of the trial court.” Portillo v. Smith Commons
DC, LLC, No. CV 20-49-RC, 2021 WL 3287741, at *2 (D.D.C. Aug. 2, 2021). But “a court
should satisfy itself that is has personal jurisdiction before entering judgment against an absent
defendant.” Mwani v. bin Laden, 417 F.3d 1, 6 (D.C. Cir. 2005). And “a district court may deny
an application for default judgment where the allegations of the complaint, even if true, are
2
Rule 55(b)(1) provides for the entry of a default judgment by the clerk on the Plaintiffs’ request, but only “[if] the plaintiff’s claim is for a sum certain.” Id. Here, Plaintiffs have requested injunctive relief and, therefore, needed to apply to the Court for a default judgment.
4
legally insufficient to make out a claim.” Gutierrez v. Berg Contracting Inc., No. CIV. A. 99-3044 (TAF), 2000 WL 331721, at *2 (D.D.C. Mar. 20, 2000).
IV. ANALYSIS
A. Jurisdiction and Venue
Plaintiffs have asserted claims under various federal laws including: the Lanham Act, the
Computer Fraud and Abuse Act, and the Electronic Communications Privacy Act. See Compl.
¶¶ 54–90. As this Court found when it issued the TRO, there is subject matter jurisdiction over
those claims. See 28 U.S.C. § 1331 (“The district courts shall have original jurisdiction of all
civil actions arising under the Constitution, laws, or treaties of the United States.”); Ex Parte
TRO and O.S.C. Re Prelim. Inj. ¶ 1, ECF No. 12. Additionally, this Court has supplemental
jurisdiction over Plaintiff’s common law trespass to chattels, conversion, and unjust enrichment
claims. See 28 U.S.C. § 1367 (“[I]n any civil action of which the district courts have original
jurisdiction, the district courts shall have supplemental jurisdiction over all other claims that are
so related to claims in the action within such original jurisdiction that they form part of the same
case or controversy.”).
Venue is also proper in this judicial district as a substantial part of the events or
omissions giving rise to Plaintiff’s claims have occurred within this district. Plaintiffs have
identified that individuals targeted by Defendants’ attacks “predominately reside in the U.S., in
and around the Washington D.C. area.” See Compl. ¶ 14.
B. Service of Process
“Before a federal court may exercise personal jurisdiction over a defendant, the
procedural requirement of service of summons must be satisfied.” Mwani v. bin Laden, 417 F.3d
1, 8 (D.C. Cir. 2005) (quoting Omni Cap. Int’l, Ltd. v. Rudolf Wolff & Co., 484 U.S. 97, 104
5
(1987)). Additionally, to satisfy due process, the method of service must be “reasonably
calculated, under all the circumstances, to apprise interested parties of the pendency of the action
and afford them an opportunity to present their objections.” Mullane v. Central Hanover Bank &
Trust Co., 339 U.S. 306, 314 (1950). Plaintiffs alleged that Defendants are “Russia-based
cybercriminals,” and thus, Defendants can be served according to Rule 4(f), which governs
service to individuals in foreign countries. See Fed. R. Civ. P. 4. Rule 4(f)(3) permits service
“by other means not prohibited by international agreement, as the court orders.” Id. And “[t]o
validly effectuate service under Rule 4(f)(3), a plaintiff must affirmatively seek and obtain the
district court's authorization for a particular means of service.” Zavadovsky v. Rabl, No. CV 24-1997 (RC), 2025 WL 2466024, at *10 (D.D.C. Aug. 27, 2025). Courts in this district have relied
on Rule 4(f) to permit both service by email and service by publication. See, e.g., Juniper
Networks, Inc. v. Bahattab, No. CIV.A. 07-1771 (PLF), 2008 WL 250584, at *2 (D.D.C. Jan. 30,
2008) (authorizing service by electronic mail under Rule 4(f)(3)); Kaplan v. Hezbollah, 715 F.
Supp. 2d 165, 167 (D.D.C. 2010) (authorizing service by publication under Rule 4(f)(3)).
Additionally, “in the case of persons missing or unknown, employment of an indirect and even a
probably futile means of notification is all that the situation permits and creates no constitutional
bar to a final decree foreclosing their rights.” Mwani, 417 F.3d at 8 (quoting Mullane, 339 U.S.
at 317).
Plaintiffs requested permission to serve Defendants by email and publication. Pls.’ Mem.
Supp. Appl. Emergency Ex Parte TRO and O.S.C. Re Prelim. Inj. at 34, ECF No. 4-1. This
Court subsequently granted that request and authorized service “by any means authorized by
law” including service by email and publication on “a publicly available Internet website.” Ex
Parte TRO and O.S.C. RE Prelim. Inj. at 10–11. Plaintiffs aver that they “served email addresses
6
associated with the Defendants’ Internet domains” on October 3, 2024. Pls.’ Br. at 3. And the
“emails were repeatedly opened and viewed by Defendants between October 3, 2024 and the
present.” Id. Additionally, Plaintiffs served Defendants by publication beginning on October 3,
2024.3 See id.
Despite online publication and emailed notice, Defendants ignored this lawsuit. The
combination of service by email and by publication does not violate any international agreement
and is reasonably calculated to achieve notice to the Defendants.4 Accordingly, the Court
concludes that service by email and publication was sufficient.
C. Default Judgment
As noted above, before entering a default judgment, the Court must evaluate Plaintiffs’
complaint to be sure that it sufficiently states a claim for which relief can be granted. See
Gutierrez, 2000 WL 331721, at *2.
D. Lanham Act Claims
Plaintiffs bring claims under the Lanham Act for trademark infringement and false
designation of origin. See Compl. ¶ 71–90. “To prevail on a claim for federal trademark
infringement . . . and false designation of origin, ‘the plaintiff must show (1) that it owns a valid
trademark, (2) that its trademark is distinctive or has acquired secondary meaning, and (3) that
3
Plaintiffs made use of the following public domain:
https://noticeofpleadings.com/starblizzard/. See Pls.’ Br. at 8.
4
Russia and the United States are both parties to the Hague Convention on the Service Abroad of Judicial and Extrajudicial Documents in Civil or Commercial Matters, however, the convention is inapplicable where, as here, the address of the persons to be served is unknown. See Convention Done at the Hague Nov. 15, 1965;, T.I.A.S. No. 6638 (Feb. 10, 1969) (“This Convention shall not apply where the address of the person to be served with the document is not known.”); BP Prods. N. Am., Inc. v. Dagra, 236 F.R.D. 270, 271 (E.D. Va. 2006) (“[T]he Hague Convention does not apply when a defendant’s address is unknown and the attempts at service have been futile.”); see also Pls.’ Br. at 8 (“Plaintiffs were unable to specifically and definitively determine the ‘real’ names and physical addresses of Defendants.”).
7
there is a substantial likelihood of confusion between the plaintiff’s mark and the alleged
infringer’s mark.’” AARP v. Sycle, 991 F. Supp. 2d 224, 229 (D.D.C. 2013) (quoting Globalw
Ltd. V. Carmon & Carmon Law Office, 452 F. Supp 2d 1, 26–27 (D.D.C. 2006)).
At the default judgment stage, Defendants have conceded that Microsoft and NGO-ISAC
member organization Carnegie Corporation of New York’s trademarks are valid and that they
have distinctive or secondary meaning. Microsoft and NGO-ISAC have also provided their
federal trademark registrations in their complaint. See Compl. Apps. B & C. Plaintiffs have
alleged that, as part of their scheme, Defendants present targets with “a webpage that appears to
be a Microsoft login page,” and that they use “Microsoft brands and trademarks . . . to confuse
Microsoft’s customers into clicking on Malicious links that they believe are associated with and
owned by Microsoft.” Compl. ¶ 45. As an example, Plaintiffs provide an image, see id. fig. 10,
of a “cloned phishing portal used by the . . . Defendants to directly impersonate [Microsoft].” Id.
¶ 37. The clear purpose and effect, when successful, in using Plaintiffs’ trademarks is to confuse
targets into thinking that Defendants’ domains are actually controlled by the owners of the
trademarks to induce targets to provide the sought after credentials or information. Additionally,
Plaintiffs allege that Defendants have impersonated Carnegie Corporation of New York, an
NGO-ISAC member, “in its spear phishing emails to its target victims.” Id. ¶ 50. Thus, the
allegation in the complaint sufficiently makes out claims of trademark infringement and false
designation of origin under the Lanham Act.
E. Computer Fraud and Abuse Act Claim
The CFAA provides a private cause of action for any person “suffering damage or loss”
from a violation of the act. 18 U.S.C. § 1030(g). Additionally, a civil action under § 1030(g)
can only be brought “if the conduct involves 1 of the factors set forth” in one of the five
8
subclauses of subsection (c)(4)(A)(i). Id. The only subclause relevant to Plaintiffs’ claims
requires “loss to 1 or more persons during any 1-year period . . . aggregating at least $5,000 in
value.” § 1030(4)(A)(i)(I). Defendants can violate CAFA in numerous ways: “intentionally
access[ing] a protected computer without authorization and as a result of such conduct, caus[ing]
damage and loss,” § 1030(a)(5)(C); “intentionally access[ing] a computer without authorization
or exceed[ing] authorized access, and thereby obtain[ing] information from any protected
computer,” § 1030(a)(2); and “knowingly caus[ing] the transmission of a program, information,
code or command, and as a result of such conduct, intentionally caus[ing] damage without
authorization to a protected computer. § 1030(a)(5)(A). The statute also defines a “protected
computer” as a computer “which is used in or affecting interstate or foreign commerce,”
§ 1030(e)(2), and it defines “exceeds authorized access” as “to access a computer with
authorization and to use such access to obtain or alter information in the computer that the
accesser is not entitled so to obtain or alter.” § 1030(e)(6).
Plaintiffs alleged that Defendants engineer their spear phishing emails to “deceive their
victims into thinking that they are responding to a legitimate email and to trick them into opening
a malicious link or attachment.” Compl. ¶ 19 (emphasis added). When successful, Defendants
“gain unfettered access and control of the victim’s inbox.” Id. In some cases, the Defendants
then use their access to “exfiltrate mailing lists and other contact information” as well as
“exfiltrate[] emails and attachments from the inbox of victims.” Id. ¶ 41. The core goal of
Defendants’ scheme is to gain access to target’s email accounts without their knowledge or
consent. Microsoft and NGO-ISAC have also alleged that they have expended more than
$1,000,000 and $200,000 respectively responding to these attacks, which is far greater than the
9
$5,000 loss required by the statute. See id. ¶ 48. Thus, Plaintiffs have successfully demonstrated
a claim against Defendants under the CFAA.
F. Electronic Communications Privacy Act Claim
ECPA prohibits “intentionally access[ing] without authorization a facility through which
an electronic communication service is provided.” 18 U.S.C. § 2701(a). ECPA provides a civil
cause of action for “any provider of electronic communication service, subscriber, or other
person aggrieved by any violation of this chapter.” § 2707(a).
Plaintiffs have alleged that “the Star Blizzard Defendants use stolen credentials and
replayed authentication tokens to directly sign in to victim email accounts.” Decl. of Sean Ensz
¶ 34, ECF No. 4-2. As an example, Plaintiffs allege that the Defendants, in a successful phishing
operation, were able to “obtain unique grant numbers associated with a[n] [NGO-ISAC] member
organization’s grant issuing process.” Pls.’ Br. at 17. This is precisely the conduct that ECPA
was designed to prevent. In re DoubleClick Inc. Priv. Litig., 154 F. Supp. 2d 497, 507 (S.D.N.Y.
2001) (“[Section 2701] aims to prevent hackers from obtaining, altering or destroying certain
stored electronic communications.”). Thus, Plaintiffs have successfully demonstrated a claim
against Defendants under ECPA.
G. Remaining Claims
Plaintiffs have brought four additional causes of action: trademark dilution under the
Lanham Act, trespass to chattels, conversion, and unjust enrichment. See Compl. ¶¶ 86–90, 91–
100, 107–114. However, “[b]ecause the Court has found that [Plaintiffs] [are] entitled to default
judgment on some [their] claims, the Court need not reach remaining claims as the scope of the
appropriate injunctive relief would not vary based on the merits of the remaining claims.”
Microsoft Corp. v. Does 1-2, No. 20-CV-1217 (LDH) (RER), 2021 WL 4755518, at *8
10
(E.D.N.Y. May 28, 2021), report and recommendation adopted, No. 20CV1217LDHRER, 2021
WL 4260665 (E.D.N.Y. Sept. 20, 2021).
H. Injunctive Relief
Plaintiffs seek a permanent injunction:
(1) prohibiting Defendants from operating or propagating the Star Blizzard
infrastructure; (2) permanently transferring ownership to Microsoft of known
malicious Star Blizzard domains identified in the Court’s prior injunction orders . .
. ; and (3) adopting an expedited process for overseeing issues with Defendants’
compliance with the permanent injunction including streamlined briefing and
regular telephonic hearings to immediately resolve these issues either by appointing
a Court Monitor or through another process under this Court’s supervision.
Pls.’ Br. at 2. “In determining whether to enter a permanent injunction, the Court considers a
modified iteration of the factors it utilizes in assessing preliminary injunctions: (1) success on the
merits, (2) whether the plaintiffs will suffer irreparable injury absent an injunction, (3) whether,
balancing the hardships, there is harm to defendants or other interested parties, and (4) whether
the public interest favors granting the injunction.” Am. C.L. Union v. Mineta, 319 F. Supp. 2d
69, 87 (D.D.C. 2004), dismissed, No. 04-5285, 2005 WL 263924 (D.C. Cir. Feb. 2, 2005).
As discussed above, Plaintiffs have succeeded by default on the merits of the action.
Plaintiffs further argue that they have suffered irreparable injury owing to the “[c]onsumer
confusion and injury to business goodwill” that is likely to occur if “Defendants are able to
continue to use domains bearing Plaintiffs’ trademarks and brands in furtherance of their
activities.” Pls.’ Br. at 22. This Court has previously found that, absent an injunction,
“irreparable harm will occur to Microsoft, Microsoft’s customer, NGO-ISAC, NGO-ISAC’s
customers, and the public.” Order Granting Mot. for Prelim. Inj. ¶ 8, ECF No. 12. Additionally,
with respect to Plaintiffs’ Lanham Act claims, “trademark infringement, by its very nature,
carries a presumption of harm.” See Hanley-Wood LLC v. Hanley Wood LLC, 783 F. Supp. 2d
11
147, 151 (D.D.C. 2011). Thus, there is ample reason to believe that Plaintiffs will suffer
irreparable injury absent a permanent injunction. Lastly, the Court finds that an injunction would
not harm Defendants or other interested parties, and that the public interest favors both
“protecting against further violation of federal copyright and trademark laws,” Hanley-Wood
LLC, 783 F. Supp. 2d at 151, and preventing the use of domains by Defendants to “conduct their
cybercriminal activity.” Pls.’s Br. at 2. Accordingly, the Court concludes that the Plaintiffs are
entitled to a permanent injunction as requested in their motion.
I. Plaintiffs’ Request for a Court Monitor
Plaintiffs have requested that the Court “adopt an expedited process of overseeing issues
with Defendants’ compliance with the permanent injunction.” Pls.’ Br. at 27. Plaintiffs have
also requested that this process “be overseen by a Court Monitor.” Id. Rule 53(a)(1)(C)
authorizes the appointment of a court monitor to “address pretrial and posttrial matters that
cannot be effectively and timely addressed by an available district judge or magistrate judge of
the district.” Fed. R. Civ. P. 53. There is precedent in cases similar to this one, in this district
and elsewhere, for the appointment of a court monitor to oversee a permanent injunction. See,
e.g., Microsoft Corporation v. John Does 1-2, Civil Action No. 19-cv-00716-ABJ; Microsoft
Corp. v. John Does 1-2, Civil Action No. 1:16-cv-993 (E.D. Va. Dec. 6, 2016). This Court
agrees with Plaintiffs that the appointment of a special master is warranted given Defendants’
ongoing establishment of new domains to effectuate their scheme, which has already required
Plaintiffs to move for a supplemental preliminary injunction on three separate occasions.
12
V. CONCLUSION
For the foregoing reasons, Plaintiffs’ Motion for Default Judgment and Permanent
Injunction is GRANTED. An order consistent with this Memorandum Opinion is separately and
contemporaneously issued.
Dated: August 5, 2026 RUDOLPH CONTRERAS
United States District Judge
13