Case Study: Microsoft DCU dismantles RaccoonO365 with Chainalysis Reactor

Microsoft Digital Crimes Unit stops RaccoonO365 using Chainalysis after 5,000 credential thefts

The Microsoft Digital Crimes Unit (DCU) faced the challenge of dismantling RaccoonO365, a prolific Phishing-as-a-Service operation that lowered the barrier to entry for cybercriminals. The group had stolen thousands of credentials, targeted the healthcare sector, and facilitated over $100,000 in illicit payments via cryptocurrency. To combat this, the DCU employed Chainalysis Reactor to trace these complex, cross-chain transactions.

Using Chainalysis Reactor, investigators traced payments across Bitcoin, Ethereum, and Tron blockchains. This provided the clear, court-ready evidence needed to win a historic civil case, which led to the seizure of 338 malicious domains. The investigation also identified the operator and the Nigerian exchanges used to cash out, resulting in the individual's arrest and the complete disruption of the criminal ecosystem.

Microsoft Digital Crimes Unit (dcu)