Case 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 1 of 33 PageID# 1

OCT 26 20
IN THE UNITED STATES DISTRICT COURTFOR THE EASTERN DISTRICT OF VIRGINIA
Alexandria Division

CLERK. U.fj. r :.rr

' '-.OJRT
iOniA. VIPGl'f^iA

MICROSOFT CORPORATION, a

Washington corporation,
Plaintiff,

Civil Action No: I] )'7' '^\l' ^V.

JOHN DOES 1-2, CONTROLLING ACOMPUTER NETWORK AND THEREBYINJURING PLAINTIFF AND ITSFILED UNDER SEAL PURSUANT TO
LOCAL RULE 5

CUSTOMERS,

Defendants.

COMPLAINTI.

INTRODUCTION

1.

Plaintiff MICROSOFT CORP. ("Microsoft") hereby complains and alleges that

JOHN DOES 1-2 (collectively "Defendants"), have established an Internet-based cyber-theft

operation referred to as "Barium." Through Barium, Defendants are engaged in breaking into theMicrosoft accounts and computer networks of Microsoft's customers and stealing highly sensitive

information. To manage and direct Barium, Defendants have established and operate a networkof websites, domains and computers on the Internet, which they use to target their victims, infecttheir computing devices, compromise the security of their networks, and steal sensitive

information. Accounts and profiles used by Defendants on certainpublicly accessible websites tooperate Barium are set forth at Appendix A and are referred to as the "Barium Profiles." Internet

domains used by Defendants to operate Barium are setforth at AppendixB to this Complaint andarereferred to as the "Barium Command and Control Domains." Microsoft alleges as follows:-1-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 2 of 33 PageID# 2

II.

NATURE OF ACTION

2.

This is an action based upon: (1) The Computer Fraud and Abuse Act, 18 U.S.C. § 1030;(2) Electronic Communications Privacy Act, 18 U.S.C. § 2701; (3) Trademark Infringement under
the Lanham Act, 15 U.S.C. § 1114 et seq. (4) False Designation of Origin under the Lanham Act,
15 U.S.C. § 1125(a); (5) Trademark Dilution under the Lanham Act, 15 U.S.C. § 1125(c);(6) common law trespass to chattels; (7) unjust enrichment; (8) conversion; and (9) intentional

interference with contractual relationships. Microsoft seeks injunctive and other equitable relief
and damages against Defendants who operate and control a network of computers that include theBarium Profiles and the Barium Command and Control Domains. Defendants, through their illegal
activities involving Barium, have caused and continue to cause irreparable injury to Microsoft, itscustomers and licensees, and the public.
III.

PARTIES

3.

Plaintiff Microsoft is a corporation duly organized and existing under the laws of the Stateof Washington, having its headquarters and principal place of business in Redmond, Washington.
4.

On information and belief, the Defendants control the Barium Profiles and the Barium

Command and Control Domains in ftirtherance of conduct designed to cause harm to Microsoft,

its customers and licensees, and the public. Microsoft is informed and believes and thereupon
alleges that Defendants can likely be contacted directly or through third-parties using theinformation set forth in Appendix B.

5.

Third parties VeriSign, Inc., VeriSign Information Services, Inc., and VeriSign Global

Registry Services (collectively, "VeriSign") maintain the domain name registry that oversee theregistration of all domain names ending in ".com." VeriSign Information Services, Inc., VeriSign,
Inc. and VeriSign Global Registry Services are located at 12061 Bluemont Way, Reston, Virginia
20190.

6.

Set forth in Appendix B is the identity of and contact information for the third-party

domain registry that controls the domains used by the Defendants.

7.

Set forth in Appendix A are the accounts and profiles that the Defendants use to operate- 2 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 3 of 33 PageID# 3

and configure Barium malware.

8.

On information and belief, Defendantsjointly own, rent, lease, or otherwise have dominion

over the Barium Profiles, the Barium Command and Control Domains, and related infrastructure,and through those control and operate Barium. Microsoft will amend this Complaint to allege the
Defendants' true names and capacities when ascertained. Microsoft will exercise due diligence todetermine Defendants' true names, capacities, and contact information, and to effect service upon
those Defendants.

9.

Microsoft is informed and believe and thereupon alleges that each ofthe fictitiously named

Defendants is responsible in some manner for the occurrences herein alleged, and that Microsoft's
injuries as herein alleged were proximately caused by such Defendants.
10.

On information and belief, the actions and omissions alleged herein to have been

undertaken by Defendants were actions that Defendants, and each ofthem, authorized, controlled,

directed, or had the ability to authorize, control or direct, and/or were actions and omissions each

Defendant assisted, participated in, or otherwise encouraged, and are actions for which each
Defendant is liable. Each Defendant aided and abetted the actions of Defendants set forth below,

in that each Defendant had knowledge of those actions and omissions, provided assistance andbenefited fi-om those actions and omissions, in whole or in part. Each Defendant was the agent ofeach of the other Defendant, and in doing the things hereinafter alleged, was acting within thecourse and scope of such agency and with the permission and consent of other Defendant.
IV.

JURISDICTION AND VENUE

11.

The Court has subject matter jurisdiction over this action pursuant to 28 U.S.C. § 1331

because this action arises out of Defendants' violation of the Federal Computer Fraud and Abuse
Act (18 U.S.C. § 1030), Electronic Communications Privacy Act (18 U.S.C. § 2701), and theLanham Act (15 U.S.C. §§ 1114, 1125). The Court also has subject matter jurisdiction over
Microsoft's claims for trespass to chattels, unjust enrichment, conversion, and intentional

interference with contractual relationships pursuantto 28 U.S.C. § 1367.

12.

Venue is proper in this judicial district pursuant to 28 U.S.C. § 1391(b) because a- 3 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 4 of 33 PageID# 4

substantial part of the events or omissions giving rise to Microsoft's claims has occurred in thisjudicial district, because a substantial part of the property that is the subject of Microsoft's claims

is situated in this judicial district, and because a substantial part of the harm caused by Defendants
has occurred in this judicial district. Defendants maintain Internet domains registered in Virginia,

engage in other conduct availing themselves of the privilege of conducting business in Virginia,
and have utilized instrumentalities located in Virginia and the Eastern District of Virginia to carryout the acts of which Microsoft complains.

13.

Defendants have affirmatively directed actions at Virginia and the Eastern District ofVirginia by directing malicious computer code at the computing devices and high-value computer
networks of individual users and entities located in Virginia and the Eastern District of Virginia,
attempting to and in fact infecting those computing devices with malicious code to compromise
the security of those systems, and attempting to and in fact stealing sensitive information fromthose networks, all to the grievous harm and injury of Microsoft, its customers and licensees, andthe public. Figure 1, below, depicts the geographical location of user computers in and aroundthe Eastern District of Virginia, against which Defendants are known to have directed fraudulent
acts and malicious code, attempting to and in fact infecting those computers, thereby
compromising their security and subjecting them to theft of sensitive information.

- 4 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 5 of 33 PageID# 5

Figure 1
OiUjod .

1

f I \UlCM•$>
Mtlcon\s«^,

En<©tt Cily-\ • ^ ^BnmtMick

DcnnOvHW\Oat*tPhHhspi

PJrtomatttlaWarr edf - ,9Pclfttbufo

WoodttUk"S5i«f*-lo«W«r«tM«'Alei^ndnj

0<U Oty/Natf^nutfOttfft

vnoi- tt ^

Vn

MMod iv-i •'
\

•/

'

C»p

Coocgttonfn

SlC^uHet
MAibomH«rmonbum

UP««U

Mofttcrty--S«tnbu/y
OoMnOi

Mctnvood

UxmQton P»niM«tntonMontroii
Ch«Hcmrtvtft«

Pa<oci}pl[« City

WAfmSpdngt
MmcIow Bluff

BucnaVlttA
Wttsto Stonamch>Mr'tintonTuckiho#>R<timond

BonL•CC© —"""

lynchburg• I«, B«dfo#dUMlcsburg

Hoprwrll

ftuttburg

ViSoflnfaurg„

Cm SprvM

Newport Ncm

Ch«rtoCl« Court Komw

HamptonOmmmUm

/

OpwMr

W.I

ts,W

Luncnburg
Suffolk

Wolf Ttu

Mount Ally??

tmponj „r,«,l<lif,

VimRni BCKhu«.
RcidivtOt

14.

Defendants maintain the Barium Command and Control Domains registered throughVerisign, which resides in the Eastern District ofVirginia. Defendants use these domains to direct
attacks against targeted networks, to infect computing devices connected to those networks that
permit Defendants to compromise the security and conduct reconnaissance of and move latterly
through those networks, and to locate and exfiltrate sensitive information from those networks.

Defendants have undertaken the acts alleged herein with knowledge that such acts would cause
harm through domains located in the Eastern District of Virginia, through the Barium Command

and Control Domainsmaintainedthrough facilities in the EasternDistrict ofVirginia,and throughcomputing devices and computer networks located in the Eastern District of Virginia, thereby

injuring Microsoft, its customers and licensees, and others in the Eastern District of Virginia andelsewhere in the United States. Therefore, this Court has personal jurisdiction over Defendants.

15.

Pursuant to 28 U.S.C. § 1391(b),venue is proper in thisjudicialdistrict. A substantial part

-5-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 6 of 33 PageID# 6of the events or omissions giving rise to Microsoft's claims, together with a substantial part of theproperty that is the subject of Microsoft's claims, are situated in this judicial district. Venue isproper in this judicial district under 28 U.S.C. § 1391(c)because Defendants are subject to personal
jurisdiction in this judicial district.
V.

FACTUAL BACKGROUND

A. Microsoft's Services And Reputation

16.

Microsoft® is a provider of the Windows® operating system and the Internet Explorer®

web browser, and a variety of other softAvare and services, including Microsoft Word, Microsoft
PowerPoint, and cloud-based services offered in connection therewith. Microsoft has invested

substantial resources in developing high-quality products and services. Due to the high quality

and effectiveness of Microsoft's products and services and the expenditure of significant resourcesby Microsoft to market those products and services, Microsoft has generated substantial goodwill

with its customers, establishing a strong brand and developing the Microsoft name and the namesof its products and services into strong and famous world-wide symbols that are well-recognizedwithin its channels of trade. Microsoft has registered trademarks representing the quality of its
products and services and its brand, including Microsoft, Windows, and Internet Explorer. Copiesof the trademark registrations for the Microsoft, Windows, and Internet Explorer trademarks areattached as Appendix C to this Complaint.
B. Barium

17.

Barium is highly sophisticated, well-resourced, organized, and patient. Barium specializes

in targeting high value organizations holding sensitive data, by gathering extensive information
about their employees through publicly available information and social media, using that

information to fashion phishing attacks intended to trick those employees into compromising their
computers and networks, compromising legitimate enterprise software provider's products notprotectedby antivirussoftware, and disguising its activitiesusingthe namesofMicrosoftand other
legitimate companies.

- 6 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 7 of 33 PageID# 7

C. Barium's Tools

18.

Althoughthe Barium Defendants have relied on differentand distinct infrastructures in aneffort to evade detection, Bariumused the same e-mail address (hostay88@gmail.com) to register
malicious domains used in connection with at least two toolsets that Barium has employed tocompromise victim computers. As shown in Figure 1, below, Barium registered the domains
nott3ed.com and operatingbox.com using this e-mail address, and Barium also linked the samee-mail address to a Microsoft account (johnxl9@hotmail.com) that was used to create malicious
profiles on the Microsoft Forums website TechNet to configure the "Barlaiy" malware on victim
computers (the Barlaiy malware is described in Part D.l, below).

- 7 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 8 of 33 PageID# 8

Figure 1

Phlshing EmailBailaly Halwaie

ShadowPad Maiwate•nBailalyPtolU«

johnxl9ghotmall com

op«tatinQbo> com

Command & Con&oi

nolp«dcom@
nostay88@gmatl.com-8-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 9 of 33 PageID# 9

D. Barium's Method Of Compromising And Stealing Information From Victims

19.

The Barium Defendants have employed at least two methods of compromising victim

computers. The first method, described in Part D.l, below, involves the "Barlaiy" and "PlugXL"

malware, which the Barium Defendants propagate using phishing techniques. The second method,
described in Part D.2, below, involves the "ShadowPad" malware, which the Barium Defendants

have distributed via a third-party software provider's compromised update.
1. Barium Method 1; "Barlaiv** And "PlugXL" Malware

a.

20.

Barium Defendants Deliver ^^Barlaiy" And 'TlugXL" Malware
Using Phishing Attacks

After selecting a victim organization. Barium will identify individuals employed by thatorganization and attempt to ascertain their personal or work e-mail addresses. To enhance theeffectiveness of phishing attacks into the organization, Barium will collect additional backgroundinformationfrom social media sites. Employing a technique known as "spear phishing," Barium
has heavily targeted individuals within Human Resources or Business Developmentdepartmentsof the targeted organizations in order to compromise the computers of such individuals.
21.

In a typical spear phishing attack. Barium sends the targeted individual an e-mailspecifically crafted to induce that individual to take some action that will lead to the compromiseof their computer. Using the information gathered from its reconnaissance on social media sites,

Barium packages the phishing e-mail in a way that gives the e-mail credibility to the target user,
often by making the e-mail appear as if it were sent from an organization known to and trusted by
the victim or concerning a topic of interest to the victim. Barium uses the lure of a resume or

documents relatedto a currentknownprojectthat the target may be developing.
22.

Figure 2 depicts an example of such a spear phishing e-mail directed to a potential victim

who is a customer and user of Microsoft's Hotmail e-mail service:- 9 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 10 of 33 PageID# 10

Figure 2
Jim Hugnes <jimhugnesx@gmail com:ke^hoBr.al.com

I

5 IS 2016

Hil
Q We removed extra line breaks from this message.
project documents.7z....
134 KB

Hi,My name is Jim, Project Manager of this project.
Our company looking for freelance developer to enhance and upgrade our application.
Please refer to the project requirements and details attached. Do reply me if you are interested.
Dont worry about the payments. If you think you could do it,we could pay you half upfront or you

could bill us prc^ressively at each stage of the development.
We could build long term relationship for future projects too. Looking forward to your reply.
ThanksJim Hughes

Em3il:Jimhughesx@gmall.com Skype:jimhughes

23.

In the phishing e-mails sent to victims by the Barium Defendants (often specificallytailored to the victim), there are file attachments or links that lead to malicious executable code.
Compressed file archives such as "7z," "ACE" and "RAR" file attachments are used to hide themalicious code, which fhistrate automated e-mail malware detection. For instance, in the above

example phishing e-mail, a malicious archive entitled "project documents.7z" can be seen.
Because compressed file archives are not inherently malicious, these specific archives are able to
avoid network detection and deliver further malicious files, which are then used to deliver

malware. For example, Barium's archives may include one or more of the following:

24.

•

Windows Shortcut (.Ink) file with hidden payloads;•

Windows Compiled HTML Help files (.chm);•

Microsoft PowerPoint document with executable macro code;•

Microsoft Word document with executable macro code; and/or•

Microsoft Word document containing exploit code.

When the victim clicks on one of these links or opens the files, it causes the malware to beinstalled on the victim's Windows-based computer.

- 10-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 11 of 33 PageID# 11

b.

25.

Operation Of "Barlaiy" and "PlugXL" Malware

Barium Defendants install the malicious "Win32/Barlaiy" malware and the malicious"Win32/PlugX.L" malware on victim computers using the means described above.

Both

Win32/Barlaiy & Win32/PlugX.L are remote access "trojans," which allow Barium to gather avictim's information, control a victim's device, install additional malware, and exfiltrate
information fi-om a victim's device.

26.

Barium Defendants install the malicious credential stealing and injection tool known as"Win32/RibDoor.A!dha." This form of malicious executable software may be wrapped within acustom dropper software known as "RbDoor," which requires a command-line password to
execute the included malware, allowing the Barium Defendants to evade antivirus software andother threat-prevention tools utilized by Microsoft and its customers.
27.

In order to transmit stolen information to Barium and execute additional instructions, eachofthese forms of malware needs to identify and communicate with external servers on the Internet

from which the malware receives instructions and configuration files. These external servers withwhich the malware communicates are called Command and Control ("C&C") servers.
28.

Barium Defendants go to great lengths to conceal the identity and location of their C&C

servers through the following means.

The Barium Defendants configure their malware tocommunicate with fake website "profile" pages that the Defendants have already set up on social
media websites, blog websites and forums, and publicly posted documents on other legitimate
websites (although the specific profiles, posts, and documents published by Defendants are fakeand malicious).

29.

Once installed on victims' computers, the malware is designed to reach out to these fakewebsite profiles and documents and search for particular text strings (pre-defined textual"anchors"), such as comments or random alphanumeric text, that can be decoded and read by themalware to obtain configuration files and the IP addresses and ports of other C&C servers. Oncethe malware decodes the text strings, it is able to connect to C&C servers from which it obtains
additional instructions and to which it sends stolen information.

- 11 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 12 of 33 PageID# 12

30.

Barium uses this mechanism to conceal the IP addresses of C&C servers and evadedetection, as the general websites that are being reached out to are legitimate blog sites and social
media sites which many users use for business or other legitimate purposes (although Defendants'
specific accounts and profiles on those websites are fake and malicious). This technique alsoenables the Barium Defendants to quickly and easily change the C&C servers, in an attempt toevade efforts by antivirus vendors and the cybersecurity community, as the malware is not limited
to a particular set of C&C domains that are "hard coded" into the malware. In particular, theBarium Defendants create fake profiles and postings for this purpose on both Microsoft-branded

websites as well as those of other well-known technology companies. The specific file paths ofthese fake and malicious profiles include the URLs set forth on Appendix A of the Complaint.
31.

The table in Figure 3, below, is a sample list of such websites showing examples of theformat of the encoded malware configuration files:'Figure 3
WebsiteURL Format

Microsoft's LinkedIn

www. linkedin. com/in/<ActorControlledProfile>(professional social
networking website)
Microsoft's Microsoft

Social msdn. microsoft. com/Profile/<ActorControlledProfile>

Developer Network (forum
for software developers)
Microsoft's TechNet (forum Social, technet. microsoft. com/Profde/<ActorControlledProfile>for software developers)
Microsoft's Forums (forum) Social microsoft. com/Profde/<ActorControlledProfile>
Google Docs (website)
Docs, soosle. com/document/<ActorControlledDocument>
GitHub (website)

32.
for

GitHub. com/<ActorControlledProiect>

As shown in Figure 4a, the Barium Defendants haveusedTechNet to createa fake profile
a

fake

user.

On theprofile, theBariumDefendants

included thetext"{OOarFJ9wgqvTVgqHln51ftme+25/}" in the "About Me" section of the site. The malware

installed on an infected computer searches this particular profile for theand "}" braces text.

The Barium Defendants create fake profiles on non-Microsoft websites as well. Forexample,
fake profiles for this purpose have been seen on the Dropbox, PasteBin, Google Docs, GitHub,
Facebook, WordPress and Twitter websites.

-12-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 13 of 33 PageID# 13

When the malware locates that text, it knows to read and decode the text between the braces inorder to generate the IP address and port name of the C&C server that the malware ultimately
communicates with to receive operational instructions and to send stolen information:
Figure 4a

Mqilittt
ttazin •«iDStt cenM

ttnimsatf cinwaetq^ t>c«craiMtrm

WihSZ/Barlaiy MatWare Cohfig:{OOarPJ9wgqvTVgqHIn51ftme4 2S/)

Oso^.Qsf'
picfiitsni *56
t

I.

"A

e liiCirteh
..•4-

.,

33.

„•

r'

.

Similarly, in example shovm in Figure 4b, the Barium Defendants have created a malicious

document on the Google Docs website.

In the document, Barium included the text"{weLXWKq/6F£EsoAXVNPDNW0vmMXL}".

The malware installed on an infectedcomputer opens the Google Docs document and searches for the "{" and "}" braces text, and themalware decodes the text between the braces to generate the IP address and port name of the C&C
server:-13-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 14 of 33 PageID# 14

Figure 4bC

i Secure https://docs.google.coni/document/d/lGcGElQtisQ1zujeFD5ebiil_Z)aQ93Z)0)'CHEqZKdOQ-OI/edit?pli=iaamp;usp=emtaed_fa... ☆

1GcG5^
File

onFeDruary26 2016 by Google TeamEdy^- ooQ H =5

IE- MOT* -

6

y - ^

7

I{weLXWKq/6FfEsoAXVNPDNW0vmMXL})

34.
the

Similarly, as shown in Figure 4c, the Barium Defendants have created a malicious file on
GitHubwebsitethat

includes"$finebnjdehejflhlmhlhiloojpghodhclkgdfchbhagpglgnniii$".

the

text

The malware searches the

document for the "$" and "$" symbols, and when it locates these symbols, the malware decodes

the text betweenthe symbols to generatethe IP address and port name of the C&C server:
Figure 4c
pnvatepem / rsa
92 ltn*< <)l <loc)hct|a;//(tthub.cacn/prtvitipcfn/(u/w0wm«>tcr/publlcj»r

OW4Kh»

Rnir

1.91 ICS

0

Blame

*Sui

0

Kbloty

O

VFoik

0

/

9

Prlvjt«-Lln<i: U•g0«l)yClwoY«Jf2Wfg}l/6U3VBJ.llJlM*6U«(«KcCg06ZeHI«ltpSc.*8*SM

N&«<U*«Q«««»lT0FBrHYI>u.>TKCL('>^r<Hab«hA<t(k]v]i<lk64«eihcQM

rpH3oykqtl.P3A3ovVs$6Z01s2p:M>efhvQCNokfIkU>32FUQit(^]uh»/«a3252
Klq2n:01«:drflt$n:0gY>yxClES*gqrub(li«n*ie4M]»4ltaVLtdlSi(^ilc]v2M}ttK)fWl.HwkOOrjUii<lefT^7jt/l.2t7til7Hu-(Hy«JylllteBrrtJHOl/v*I.0UTr9n<|FWl«nuh0ljrsUJnkFTF74t/l«2r7lll7Hu.Etly«SytNl0B2>UH0l/vltI»euT:9

eeSICZCMhWilYjRri>y8yOkq4YtwSnSQPrrYfUSt»hAx«Ekjv]sclkfi4«eihcQAA
tH*/trC:FT74ltiSppUSbeezX3K(;biLV]tlC2g*rcrPt«VS]<lAqv>4trcfUSlQPO*X*aT«u(Baf>ff-irAA^0af•i0DPG}yctwoYa3fzOtfs)l/6UjVt>2«d|M%6inCSMcCgG6ZeBlOKKpSC4Xteerl

AlB!|XK/n<|]CIFfrYD]BHti>V0;<]HAVrl;c9vclCvMpk<iilMTQ*vASM<2Kl)VYxlpya•«0K)yclMYa]f2G»;(31/6UjVIi2.dlA(Hk«I)«CeHcC(«ZEEIIGXKpSe«X8e«rl
MiflAMaiqVOxELijHvtclqY»W/U»HvPtlT2kktOqnlf«|>e51/Qli^Ihfng«)x«}6Rl
tBWTqtIB?

rMOMUKySah
ntys

ifloc&nl<tti«]fltaiiAlhUMjMtM«iclk8dfdibhis«l<nilltf<|(9}fI»U/«r£2FT79l(appWSbC8lX3i(qblLVJbC2iArtrP»1(Af6J(l*qvs9lrcflLSlQPOaX
tOriuCNrgltAAAAcQC/ckydgS)2t<n«]ttio]](Pt«t2qiO]D2UkbkMBXaN11tQS/«OSI«2C)m«llV]KfoySyCkqqYMfnV}PfTYMMb«rvAx>(k]v2tclkMjBzhc(}UXQ^/y>IO«ZkjrBEc/Zl9HT0XyeiAACMIG«JW<OQ«uS01T0f>rHyPu.sTltClg«•OTtuCe4>-g)tAA«*gQC/ckyilgS32>«><}cte]IEf!K)12qiO]OZUkbWBX*HHlTqs/(AAI»MlnM)SUxvKU/9:Flnx*Iyt<fKp)niaSTM4a;HaGVH.<)*e7Bp01E)M
S&St6ZCHnHHrIV]XfoygyOlcqqY«.5nMQ»b/y<'IO>Zk|fB((/ZLWTtny<VUUB«*lpEIC<ttwVfCaT3InY)dSHZ»«4g3qgHSYcpkV.;i2SII2w"- 14-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 15 of 33 PageID# 15

2.

Barium Method 2: ''ShadowPad" Malwarea.

Barium Defendants Use Third-Party Software Updates To
Deliver "ShadowPad" Malware To Windows Users And

Compromise Victim Computers

35.

In addition to using phishing tactics, Barium has also devised the following sophisticatedscheme to target Microsoft customers. Barium compromised a legitimate company, NetSarang
Inc. ("NetSarang"), headquartered in South Korea with a United States subsidiary. NetSarang

provides enterprise level products that streamline data transfer over complex networks, including
products designed to operate on the Microsoft Windows platform.
36.

The NetSarang products for Windows contain a type of file called a Dynamic Link Library(DLL) file, named "nssock2.dll." Barium was able to compromise NetSarang's products bymodifying this legitimate DLL file and injecting two different bodies of malicious code into thefile, each heavily encrypted with advanced algorithms in order to conceal their purpose. The
addition of malicious code causes a change to the file size—the original file size of the legitimate
DLL file was 114896 bytes, but the modified, malicious DLL file, including extra malicious code,is 180432 bytes. Figure 5 depicts these file changes made by Barium:
Figure 5
Original DLL

Infected DLL

Digital Signature

Encrvpted Body

Digital Signature-15-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 16 of 33 PageID# 16

37.

The Barium Defendants inserted the modified, malicious file into the NetSarang build

environment, where NetSarang creates the final versions of the software that are ultimately
delivered by NetSarang to Microsoft's customers. By signing the malicious DLL files with
NetSarang's private certificate. Barium included the modified, malicious DLL file in routine

software updates for NetSarang products distributed to Windows users that would appear to be alegitimate file from NetSarang.
38.

Once the DLL file was included in the build, any enterprise using the affected NetSarang

products and receiving updates would receive the Barium malicious file through the software
update process. Barium injected the malicious file in five NetSarang products. Typically, a build
environment is in a highly secured, controlled area with limited access.

39.

The Barium Defendants' ability to accomplish this demonstrates their technical andoperational sophistication. While not detected at the time, Microsoft's antivirus and security
products now detect this Barium malicious file and flag the file as "Win32/ShadowPad.A". Thisparticular Barium-modified malicious file is referred to as "ShadowPad" malware throughout.
b.

40.

Operation of "ShadowPad" Malware

This ShadowPad malware utilizes a two-stage method to do harm. ShadowPad Stage 1

malware utilizes the capability of the Microsoft programing language C-H- runtime to invoke
automatically, meaning the malware will initialize without requiring any action by the victim. Thismethod makes the ShadowPad Stage 1 malware less noticeable and difficult for any antivirus
software to detect. ShadowPad Stage 1 malware runs continuously after its initial execution andattempts to access a Windows registry path that is unique to each victim in order to give theinfected device a persistent identifier.

41.

ShadowPad Stage 1 malware identifies and communicates with C&C servers utilizing acomplex custom algorithm. The malware leverages a Domain Generation Algorithm ("DGA") togenerate a unique Internet domain, based on month and year of the date set on the victim machine.

The infected computer reaches out for instructions to theseC&C domains. Thiscapability enables
ShadowPad Stage 1 malwareto generate a new C&C domain every month. Microsofthas reverse- 16 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 17 of 33 PageID# 17

engineered the DGA and generated the C&C domains leveraged by ShadowPad Stage 1 malware.
These C&C domains include those listed in Appendix B of the Complaint.

42.

ShadowPad leverages domain registrar QHoster to register these Stage 1 C&C domains.

Typically, in order to register a domain name, the registrant must provide identifying and contact
information, including the registrant's full name, postal address, e-mail address, phone number,administrative contact details, and technical contact details. This information is often referred toas "WHOIS" data.

43.

WHOIS data is managed by the registrar with which a domain is registered and, by default,

is publicly available in order to enable the identification and to provide contact information for thedomain owner. However, registrars may also offer a service called "Privacy Protection." This
service enables a registrant to remove from public view the WHOIS data used to register thedomain and replaces it with generic information, typically for a proxy entity. All ofthe ShadowPad

Stage 1 malware domains are registered using the Privacy Protection service that is provided by
QHoster. Figure 6 shows the difference between the normal WHOIS data for a domain and thePrivacy Protection WHOIS data for a domain, as marketed by QHoster.^ In the normal WHOIS
data, the real address and e-mail address for the owner of the domain "jsmithprod.com" can be

seen. However, in the privacy protected WHOIS information, only generic information is listed
for that domain, including a general mailing address and random e-mail address. The Privacy
Protection service is not inherently malicious in nature, but the pattern of utilizing the service isconsistent with C&C domains leveraged by the ShadowPad malware.

See Domain Name Registration.QHoster, httDs://www.ahoster.com/domains.html (last visited Oct. 25, 2017).

-17-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 18 of 33 PageID# 18

Figure 6/k Unprotect WHOIS

1

Mm Protected with ID Protect(Umm

John Smith Productions

I

35

John Smith

112Main St

1

Hollister, CA 95023

1

Whois Privacy Protection Service
Whois AgentPHB 368.14150 NE 20th St-FI
C/0 johnsmithprod.com
Bellevue, WA 98007

United States

1(555)555-1234

1

United Statesjohnsmith@jsmithprod.com

H(425)274-0657

Your information is visible to the public!

•

gmyjcxkxh@whois privacyprotectcom

44.

ShadowPad Stage 1 malware does not communicate to the C&C server directly. Instead,

ShadowPad Stage 1 malware sends information and receives C&C instructions via the Domain

Name System ("DNS") protocol. The DNS protocol is a set of processes and servers that tell acomputer attempting to visit a particular Internet domain how to resolve a request for that particulardomain and where to find the servers on the Internet for content associated with that domain.

45.

ShadowPad Stage 1 malware first attempts to perform a customized domain lookup for agiven C&C domain. It does so by doing a "lookup" ofthe C&C domain using public DNS servers
with the following IP addresses: 8.8.8.8, 8.8.4.4,4.2.2.1, and 4.2.2.2. Ifthe Domain Name lookup

for the C&C domain fails, then the ShadowPadStage 1 malware performs a Domain Name lookup
using the DNS lookup facilities that are present locally on the victim device. Barium may be using

the public DNS servers for the first lookup attempt in an effort to avoid either local logging or
whitelisting, but if the public DNS servers are not available. Barium's malware will default backto the local DNS servers in order to communicate with the C&C domain.

46.

ShadowPad Stage 1 malware collects the User Name, Machine Name (or "Hostname"),and Domain Name of the victim device, and this information is first encrypted using a custom-18-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 19 of 33 PageID# 19

algorithm and then communicated to the C&C infrastructure viathe DNS TXT record.^
47.

ShadowPad Stage 1 malware explicitly uses DNS TXT records to communicate

information from the victim's computer to Barium and to deliver instructions to the victim's
computer. The initial information transmitted over this DNS protocol channel contains key

properties of the victim's computer, allowing the Barium Defendants to understand the victim's
system and the domain that the victim has joined. This domain information, for example, reflects
which companies' computers are infected and are now Barium victims.

48.

Below, at Figure 7, is an example of the encrypted information sent in the DNS TXT

record. In particular, a portion of an Internet domain called a "sub-domain" is stored in the DNS

TXT record, and that sub-domain is encoded with the encrypted User Name, Machine Name (or"Hostname"), and Domain Name of the victim device. The C&C domain is the last portion of thewebsite address at the end of the domain path ("foryzedensrcd.com" indicated in black text in

Figure 7, below). The sub-domain, in which data is encrypted and stored in a DNS TXT record,

is the portion of the domain at the beginning of the domain path (the text highlighted in blue in
Figure 7, below).

^A "DNSTXT" record works as follows. Typically, the DNS protocol contains information in various forms ofrecords associated with a given Internet domain. For example, a DNS "A" record lists the IP address of the server
containing the content associated with the domain, and an "MX" record reflects information about an e-mail serveron the domain. A "DNS TXT" record is a type of record associated with a domain in which free-form, humanreadable text informationmay be stored describingsome attribute of the domain. DNS TXT records can be used torecord and deliver information about a domain.

- 19 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 20 of 33 PageID# 20

Figure 7

User name:

Administrator

Ho^name:

Domain:
ROOD

com

49.

Below, at Figure 8, is an example of a decoded DNS query, where the data encoded into a

sub-domain is recovered by the Defendants and can then be used by the Barium Defendants. In

particular, in this example, custom data unique to the malware is captured followed by the nameof the machine ("ANDREA_XX"), the victim's usemame ("Administrator"), and the company's

domain ("ROOD").

This information is collected to identify which companies have been

infiltrated by Barium and further analyzed in order for the Defendants to prioritize their Stage 2
malware attacks.

Figure 80008C288

00

0008C298m

0008C2A8

6E..ROODbEiI0([0|

00
41

52
4E

4F 4F 4444 52 45

41

5F 58

58

00

00

41

64

6D

69

69

73

74

74

6F 72

00

00

00

00

00

00

00

72

61

nistrator

.

50.

1

.ANDREA_XX. .Admi
i

ShadowPad Stage 1 malware awaits for a correct DNS response: a custom encrypted

response in a TXT record. A correct DNS response contains a decryptionkey for the ShadowPad

Stage 2 malware and modules associated with the ShadowPad Stage 2 malware. The decryption-20-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 21 of 33 PageID# 21

key in the DNS response would be utilized to activate ShadowPad Stage 2 malware. If the DNS

response is incorrect, then the ShadowPad Stage 1 attempts to reconnect after 8 hours.
51.

ShadowPad Stage 2 is modular, allowing Barium to customize the functionality of themalware. These modules are encrypted and stored in the Windows registry. Configuration
modules (Config modules) contain backup C&C domains used to communicate with the Barium
Defendants (for example, notped.com. described in Part D.2, above), and these backup C&C
domains can be changed as needed. Config modules enable Barium to be more agile in changing
their infrastructure, as has been observed in previous Barium incidents. Thus far, the ShadowPad
Stage 2 modules identified are "DNS," "Install," "Online," and "Plugins" modules, and analysisof these modules has identified the functionalities associated with them. ShadowPad Stage 2

modules can only be installed on the victim's computer if the ShadowPad Stage 1 malware is

successfully installed. Consequently, disrupting the Stage 1 infirastructure would halt further
infection of additional victims.

E. Barium Defendants Steal Intellectual Property And Personal Information From
Compromised Victim Computers

52.

Once the Barium Defendants have access to a victim computer through the malware

described above, they monitor the victim's activity and ultimately search for and steal sensitive
documents (for example, exfiltration of intellectual property regarding technology has been seen),
and personal information fi"om the victim's network.
53.

In the process ofinfecting and taking over control of its victim's computers. Barium causes

damage to those computers and the Microsoft Windows operating system licensed by Microsoft
to those computing device users. Barlaiy and ShadowPad are unique to the Barium Defendants.

54.

Barium uses a dropper to deploy ShadowPad malware, which eventually downloads othermodules. The following system registry hives are used by the ShadowPad malware:55.

•

HKEY_LOCAL_MACHINE\SOFTWARE\90368428\Data•

HKEY_CURRENT_USER\SOFTWARE\90368428\Data

Additionally, Barlaiy malware makes changes to the system registry, also setting up and- 21 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 22 of 33 PageID# 22

using registry paths that use Microsoft trademarked names, including the following:

56.

•

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce•

HKEY_CURRENT_USER\Soflware\Microsoft\Windows\CurrentVersion\Run

The installation of the Barium malware on a computing device essentially converts thatcomputing device into a tool that Barium then uses to attack the computing device's owner andthe network to which the computing device is connected. The Barium backdoors are composed ofseveral pieces with different functions, and the attacker can deploy a large set of tools to performtasks including key logging, e-mail address and file harvesting, information gathering about the
local computing devices, and remote communication with C&C servers.
F. Barium Has Attacked Many Microsoft Customers In Virginia, The UnitedStates, And Around The World

57.

Barium has targeted Microsoft customers both in Virginia, the United States, and aroundthe world. Figure 9a, below, shows detections of encounters with the Barium actors and theirinfrastructure, including infected computers located in Virginia, and Figure 9b, below, shows
detections of encounters throughout the United States. Each detection indicates an instance atwhich one of Microsoft's Barium-specific signatures has been triggered. VeriSign, Inc., with

headquarters in Reston, Virginia, maintains the registry for domains used by Barium in connection
with their malware infrastructure.

- 22 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 23 of 33 PageID# 23

Figure 9a
r V
VDovw

PMUppi

Pjnom

Ottawatr Bar

Pftcnburg
OtntcKi

We*«n<»nj

Wwrtnton

CMwtk '»!

D<i«C^(rtnUn*/ ,,/?'

MononfBftHs

ytiU

Mittotd

UMOn

StCtwtM

Naltanal
faintHwntanbutg

UPUU

MontimCIviau&K /'nOaidabuifl CK«p<Ka

UxingtonP^
SnowHdSUuntonMontrau

W<<m«Uiora

ChwtonnaiUt

McmIow Bluff
iMMonlAtMjni

Wlot* Stan* OMdi

Unton

TucJUhoa

Ricf^ond

Hop»w«<l

SaWffl

BlKbburg
Radfonl

CO.W

<44a

^

Newport N««w

lurxniMtg

Norfolk

WoHTria??

CipwIO*!rV/. ©

CtMtlotIt Cmi Houm

Rocky Maunt

MouRt Any

WiEuinibuig

Ptt«nbufV V

RuUbu*g

CtvvSpnng

rmktawn

Wm Pocni

Son Mlu, Bcdfonl

jtmporn M rtankim

SutfoDi* VirgmuBcKh

Cdm ^ OjnWl»

Figure 9b

9^

NOKTh DAKOTA

WASMlNCrOM

0«UN$Wt«

SOUTV* DAKOTA^

NfllAStA

OHtO

lutNOij'N0U»«A

PfNN^YlviJktA _comoOiur*u«*i9hT• . r-dUTAH

COIOIAOOKANSAS

Wf^T VtftGfNiA

U^t'tfKfKO

4

irNTuCICO

M*ai««av

UORTh q^ROill

TINNrVSIf_

lot Anotiw^^o•
I

AtABAMA

south CAJ^OMVA

CfOKOtA

MlSS*SSt»Pt

lOUlSlANAriORIDA

'l»t^

-23-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 24 of 33 PageID# 24

58.

Figure 10, below, shows the location of our detections of Barium encounters worldwide.

Barium frequently targets global and regional gaming industries. The NetSarang tools that Barium
modified with malicious code are very popular among gamers in Southeast Asia. As a result, many
gaming computers in Southeast Asia were exposed to infection.
Figure 10

i

J

\ \

ir4
s—7

UNHtO rtAIlT

J*',

PadficOcironAitonttc
Octon

/

"/V

A-. ,W"

•

•
•

\...

—

-sr

. r'

BHAZIlIndian
Ocean

•Ux
-j''

"1
Utnq

G. Harm To Microsoft And Microsoft Customers

59.

Microsoft supports customers who have been victims of Barium. Mitigating Barium

intrusions on customer networks is often extremely expensive. In typical cases where Microsoft's

Global Incident Response and Recovery team supports an intrusion response related to Barium,
average costs can range from 250,000 to approximately 1.3 million dollars per incident, or more.

This does not include the cost of new architecture, intrusion prevention devices, network security
changesto prevent future intrusions, or the damage caused by having sensitive informationstolen.
-24-

COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 25 of 33 PageID# 25

60.

Barium irreparably harms Microsoft by damaging its reputation, brands, and customer

goodwill. Microsoft is the providerof the Windows operating systemand the TechNet service, as
well as a variety of other software and services. Microsoft is the owner of the "Microsoft,""Windows," and "Internet Explorer" trademarks at Appendix C to the Complaint. Microsofthas
invested substantial resources in developing high-quality products and services. Due to the highquality and effectiveness of Microsoft's products and services and the expenditure of significant
resources by Microsoft to market those products and services, Microsoft has generated substantial
goodwill with its customers, has established a strong brand, and has developed the Microsoft nameand the names of its products and services into strong and famous world-wide symbols that are
well-recognized within its channels oftrade. Microsoft has registered trademarks representing thequality of its products and services and its brand, including the trademarks listed above.
61.

The activities of the Barium Defendants injure Microsoft and its reputation, brand, andgoodwill. Users subject to the negative effects of the Barium Defendants' malicious applications
and actions incorrectly believe that Microsoft is the source of vulnerabilities and resultant
problems. Software updating, also known as supply chain attacks, significantly threaten theMicrosoft ecosystem. Advice to customers to patch systems has been strongly advocated andcommunicated by Microsoft. The use of the supply chain attack vector, through software updates(discussed above in paragraphs 20-21), introduces a significant issue that appears to contradict
Microsoft's guidance and therefore irreparably injures Microsoft and its reputation, brand, andgoodwill.
VI.

CLAIMS FOR RELIEF
FIRST CLAIM FOR RELIEF

Violation of the Computer Fraud & Abuse Act, 18 U.S.C. § 1030

62.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 61 above.

63.

Defendants knowingly and intentionally accessed and continue to access protectedcomputers without authorization and knowingly caused the transmission of information, code and- 25 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 26 of 33 PageID# 26

commands, resulting in damage to the protected computers, the software residing thereon, andMicrosoft.

64.

Defendants' conduct involved interstate and/or foreign communications.

65.

Defendants' conduct has caused a loss to each Plaintiff during a one-year period

aggregating at least $5,000.

66.

Microsoft seeks injunctive relief and compensatory and punitive damages under 18 U.S.C.

§1030(g) in an amount to be proven at trial.
67.

As a direct result of Defendants' actions, Microsoft has suffered and continues to suffer

irreparable harm for which there is no adequate remedy at law, and which will continue unless
Defendants' actions are enjoined.
SECOND CLAIM FOR RELIEF

Violation of Electronic Communications Privacy Act, 18 U.S.C. § 2701
68.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 67 above.

69.

Microsoft's Windows operating system and Internet Explorer, Microsoft Word, andMicrosoft PowerPoint software, Microsoft's customers' computers running such software, andMicrosoft's cloud-based services offered in connection with such software and computers are

facilities through which electronic communication service is provided to Microsoft's users andcustomers.

70.

Defendants knowingly and intentionally accessed the Windows operating system, Internet

Explorer, Microsoft Word, and Microsoft PowerPoint software, Microsoft's customers' computers
running such software, and Microsoft's cloud-based services offered in connection with such

softwarewithout authorization or in excess of any authorization granted by Microsoft or any otherparty.

71.

Through this unauthorized access. Defendants intercepted, had access to, obtained andaltered authorized access to, wire electronic communications transmitted via Microsoft's Windows

operating system, Internet Explorer, Microsoft Word, and Microsoft PowerPoint software, the- 26 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 27 of 33 PageID# 27

computers running such software, and Microsoft's cloud-based services offered in connection withsuch software and computers.

72.

Microsoft seeks injunctive relief and compensatory and punitive damages in an amount tobe proven at trial.
73.

As a direct result of Defendants' actions, Microsoft has suffered and continues to suffer

irreparable harm for which no adequate remedy at law exists, and which will continue unless
Defendants' actions are enjoined.
THIRD CLAIM FOR RELIEF

Trademark Infringement Under the Lanham Act -15 U.S.C. § 1114 et seq.

74.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 73 above.

75.

Defendants have used Microsoft's trademarks in interstate commerce, including

Microsoft's federally registered trademarks for the word marks Microsoft, Windows, and Internet
Explorer. By doing so. Defendants are likely to cause conftision, mistake, or deception as to theorigin, sponsorship, or approval of the fake and unauthorized versions of the Windows operating
system and Internet Explorer software.

76.

As a result of their wrongftil conduct. Defendants are liable to Microsoft for violation of

the Lanham Act.

77.

Microsoft seeks injunctive relief and compensatory and punitive damages in an amount tobe proven at trial.
78.

As a direct result of Defendants' actions, Microsoft has suffered and continues to suffer

irreparable harm for which it has no adequate remedy at law, and which will continue unless
Defendants' actions are enjoined.

79.

Defendants' wrongfuland unauthorized use of Microsoft's trademarksto promote, market,

or sell products and services constitutes trademark infi-ingement pursuant to 15 U.S.C. § 1114 etseq.

- 27 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 28 of 33 PageID# 28

FOURTH CLAIM FOR RELIEF

False Designation of Origin Under The Lanliam Act - 15 U.S.C. § 1125(a)80.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 79 above.
81.

Microsoft's trademarks are distinctive marks that are associated with Microsoft andexclusively identify its businesses, products, and services.
82.

Defendants make unauthorized use of Microsoft's trademarks. By doing so. Defendants

create false designations of origin as to tainted Microsoft products that are likely to cause
conftision, mistake, or deception.
83.

As a result of their wrongftal conduct, Defendants are liable to Microsoft for violation of

the Lanham Act, 15 U.S.C. § 1125(a).

84.

Microsoft seeks injunctive relief and compensatory and punitive damages in an amount tobe proven at trial.
85.

As a direct result of Defendants' actions, Microsoft has suffered and continues to suffer

irreparable harm for which they have no adequate remedy at law, and which will continue unless
Defendants' actions are enjoined.
FIFTH CLAIM FOR RELIEF

Trademark Dilution Under The Lanham Act -15 U.S.C. § 1125(c)86.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 85 above.
87.

Microsoft's trademarks are famous marks that are associated with Microsoft andexclusively identify its businesses, products, and services.

88.

Defendants make unauthorized use of Microsoft's trademarks. By doing so. Defendants

are likely to cause dilution by tamishment of Microsoft's trademarks.

89.

Microsoft seeks injunctive relief and compensatory and punitive damages in an amountto

be proven at trial.

90.

As a direct result of Defendants' actions, Microsoft has suffered and continues to suffer- 28 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 29 of 33 PageID# 29

irreparable harm for which they have no adequate remedy at law, and which will continue unless
Defendants' actions are enjoined.
SIXTH CLAIM FOR RELIEF

Common Law Trespass to Chattels

91.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 90 above.

92.

Defendants have used a computer and/or computer network, without authority, with theintent to cause physical injury to the property of another.
93.

Defendants have, without authority, used a computer and/or computer network, withoutauthority, with the intent to trespass on the computers and computer networks of Microsoft and its
customers.

94.

Defendants' actions in operating Barium result in unauthorized access to Microsoft's

Windows operating system, Internet Explorer, Microsoft Word, and Microsoft PowerPoint
software, and Microsoft's cloud-based services offered in connection with such software, and thecomputers on which such programs and services run, and result in unauthorized intrusion into
those computers.

95.

Defendants intentionally caused this conduct and this conduct was unlawftil andunauthorized.

96.

Defendants' actions have caused injury to Microsoft and have interfered with thepossessory interests of Microsoft over its software.

97.

Microsoft seeks injunctive relief and compensatory and punitivedamages in an amountto

be proven at trial.
98.

As a direct result of Defendants' actions, Microsoft has suffered and continued to suffer

irreparable harm for which no adequate remedy at law exists, and which will continue unless
Defendants' actions are enjoined.

- 29 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 30 of 33 PageID# 30

SEVENTH CLAIM FOR RELIEF

Unjust Enrichment

99.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 98 above.
100.

The acts of Defendants complained of herein constitute unjust enrichment of the

Defendants at the expense of Microsoft in violation ofthe common law. Defendants used, withoutauthorization or license, software belonging to Microsoft to facilitate unlawful conduct inuring to
the benefit of Defendants.

101.

Defendants profited unjustly fi-om their unauthorized and unlicensed use of Microsoft's

intellectual property.

102.

Upon information and belief, Defendants had an appreciation and knowledge ofthe benefit

they derived from their unauthorized and unlicensed use of Microsoft's intellectual property.
103.

Retention by the Defendants of the profits they derived from their malfeasance would be

inequitable.

104.

Microsoft seeks injunctive relief and compensatory and punitive damages in an amount tobe proven at trial. As a direct result of Defendants' actions, Microsoft suffered and continues tosuffer irreparable harm for which no adequate remedy at law exists, and which will continue unless
Defendants' actions are enjoined.
EIGHTH CLAIM FOR RELIEF
Conversion

105.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 104 above.

106.

Microsoft owns all right, title, and interest in its Windows operating system, Internet

Explorer, Microsoft Word, and Microsoft PowerPoint software, and Microsoft's cloud-based
services offered in connection with such software. Microsoft licenses its software and services to

end-users.

Defendants have interfered with, unlawfully and without authorization, anddispossessed Microsoft ofcontrol over itsWindows operating system, Internet Explorer, Microsoft- 30 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 31 of 33 PageID# 31

Word, and Microsoft PowerPoint software, and Microsoft's cloud-based services offered inconnection with such software.

107.

Defendants have, without authority, used a computer and/or computer network, withoutauthority, with the intent to remove, halt, or otherwise disable computer data, computer programs,
and/or computer software from a computer or computer network.

108.

Defendants have, without authority, used a computer and/or computer network, withoutauthority, with the intent to exfiltrate documents or cause a computer to malftmction.
109.

Microsoft seeks injunctive relief and compensatory and punitive damages in an amount tobe proven at trial.
110.

As a direct result of Defendants' actions, Microsoft suffered and continues to suffer

irreparable harm for which no adequate remedy at law exists, and which will continue unless
Defendants' actions are enjoined.
NINTH CLAIM FOR RELIEF

Intentional Interference with Contractual Relationships

111.

Microsoft incorporates by reference each and every allegation set forth in paragraphs 1

through 110 above.

112.

Microsoft has valid and subsisting contractual relationships with licensees of its Windows

operating system, Internet Explorer, Microsoft PowerPoint, and Microsoft Word products, andMicrosoft's cloud-based services offered in connection with such products. Microsoft's contracts
confer economic benefit on Microsoft.

113.

Defendants' conduct interferes with Microsoft's contractual relationships by impairing,and in some instances destroying, the products and services Microsoft provides to its customers.

On information and belief, Defendants know that their conduct is likely to interfere with
Microsoft's contracts and to deprive Microsoft of the attendant economic benefits.
114.

On information and belief, Microsoft has lost licensees due to Defendants' conduct.

115.

Defendants' conduct has caused Microsoft economic harm. Microsoft seeks injunctive

reliefand compensatory and punitive damages in an amount to be proven at trial.
- 31 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 32 of 33 PageID# 32

116.

As a direct result of Defendants' actions, Microsoft has suffered and continues to suffer

irreparable harm for which no adequate remedy at law exists, and which will continue unless
Defendants' actions are enjoined.
VIL

PRAYER FOR RELIEF

WHEREFORE, Microsoft prays that the Court:
117.

Enter judgment in favor of Microsoft and against the Defendants.

118.

Declare that Defendants' conduct has been willful and that Defendants have acted withfraud, malice and oppression.

119.

Enter a preliminary and permanent injunction enjoining Defendants and their officers,

directors, principals, agents, servants, employees, successors, and assigns, and all persons andentities in active concert or participation with them, from engaging in any of the activity
complained of herein or from causing any of the injury complained of herein and fi*om assisting,aiding or abetting any other person or business entity in engaging in or performing any of theactivity complained of herein or fi-om causing any of the injury complained of herein.

120.

Enter a preliminary and permanent injunction giving Microsoft control over the domains

and accounts and profiles used by Defendants to cause injury and enjoining Defendants from using
such instrumentalities.

121.

Enter judgment awarding Microsoft actual damages fi-om Defendants adequate tocompensate Microsoft for Defendants' activity complained of herein and for any injury
complained of herein, including but not limited to interest and costs, in an amount to be proven attrial.

122.

Enter judgment disgorging Defendants' profits.

123.

Enter judgment awarding enhanced, exemplary and special damages, in an amount to be

proven at trial.

124.

Enter judgment awarding attorneys' fees and costs, and order such other relief that the

Court deems just and reasonable.

- 32 -COMPLAINTCase 1:17-cv-01224-TSE-MSN Document 1 Filed 10/26/17 Page 33 of 33 PageID# 33

Dated: October 26,2017

Respectfully submitted,
ALSTON & BIRD LLPDavid Mohl
Va. State Bar No. 84974

Attorney for Plaintiff Microsoft Corp.
ALSTON & BIRD LLP
950 F St. NW

Washington, DC 20004
Telephone: (202) 239-3300
Fax:(202) 239-3333
Email: david.mohl@alston.com
Of counsel:

MICHAEL ZWEIBACK {pro hac vice application pending)
ERIN COLEMAN {pro hac vice application pending)
Attorney for Plaintiff Microsoft Corp.
ALSTON & BIRD LLP

333 S. Hope Street, 16th Floor
Los Angeles, CA 90071
Telephone: (213)576-1000
Fax:(213)576-1100
michael.zvy^eiback@alston.com
erin.coleman@alston.com

KIMBERLY K. PERETTI {pro hac vice application pending)
Attorney for Plaintiff Microsoft Corp.
ALSTON & BIRD LLP
950FStNW

Washington, DC 20004
Telephone: (202) 239-3300
Fax:(202) 239-3333
Kimberly.peretti@alston.com

RICHARD DOMINGUES BOSCOVICH {pro hac vice
application pending)
Attorney for Plaintiff Microsoft Corp.
MICROSOFT CORPORATION

One Microsoft Way
Redmond, WA 98052-6399

Telephone: (425) 704-0867
Fax:(425) 936-7329
rbosco@niicrosoft.com- 33 -COMPLAINT