About This Court Order

This May 27, 2022 federal court order was entered in Microsoft Corporation v. John Does 1-2, Civil Action No. 1:22-cv-607 (AJT/WEF), in the United States District Court for the Eastern District of Virginia, Alexandria Division. The order granted Microsoft ex parte temporary restraining relief and required the John Doe defendants to show cause why a preliminary injunction should not issue in litigation directed at a malicious computer network and related Internet infrastructure.

The Court addressed claims under the Computer Fraud and Abuse Act and the Lanham Act, including trademark infringement, false designation of origin, and trademark dilution, together with trespass to chattels, unjust enrichment, and conversion. The order found sufficient grounds for emergency relief based on alleged malicious access to Microsoft and customer systems, theft and exfiltration of information, credential theft, remote reconnaissance, monitoring of users, deployment of command-and-control infrastructure, and the use of Internet domains and IP addresses to facilitate the defendants’ activities.

The order establishes an operational cyber-disruption mechanism directed at the domain-registration and DNS layers. For domains within the control of U.S.-located registries, the order required registry action to unlock domains and change the registrar of record to MarkMonitor or another registrar specified by Microsoft, preserve control against unauthorized transfer or modification, provide relevant registration and administrative information, and propagate the required changes through the Domain Name System. For registries and registrars outside the United States, the Court requested substantially similar assistance rather than purporting to compel foreign entities.

The Court also authorized alternative service through domain-registration and hosting contact information, publication on a publicly available Internet website, personal delivery where accurate contact information existed, and Hague Convention or similar treaty procedures where applicable. Microsoft was required to post a $15,000 bond, and a preliminary-injunction hearing was scheduled for June 10, 2022.

The combined repository PDF also contains D.E. 16-1, a 56-page Appendix A preserving domain, registry, registrar, WHOIS / RDDS, nameserver, contact, and registration metadata for infrastructure identified in connection with the requested relief. For researchers studying civil cybercrime litigation, the filing illustrates how emergency judicial process can be translated into domain-control, registrar-transfer, DNS-propagation, service, and evidence-preservation mechanisms.

Judicial Provenance

Entered by Hon. Anthony J. Trenga, United States District Judge, on May 27, 2022 at 11:30 a.m. Plaintiff: Microsoft Corporation, a Washington corporation. Defendants: John Does 1-2, described in the caption as controlling a computer network and thereby injuring Microsoft and its customers. The uploaded order does not identify Microsoft’s individual counsel, firm addresses, or counsel email addresses. Do not add counsel names from memory or inference; add them only from a companion complaint, TRO application, notice of appearance, or other docket filing that expressly provides that information.

Repository Note: CyberLawLibrary reproduces this public federal court record for legal, cybersecurity, and historical research. The combined document contains the Ex Parte Temporary Restraining Order and Order to Show Cause re Preliminary Injunction filed May 27, 2022 as D.E. 16, together with Appendix A filed as D.E. 16-1, in Microsoft Corporation v. John Does 1-2, Case No. 1:22-cv-00607-AJT-WEF, United States District Court for the Eastern District of Virginia, Alexandria Division. The court-filed copies preserve their docket ribbons, PageID pagination, and original sealed-status notation. Repository publication does not imply that CyberLawLibrary participated in the litigation or alters the Court’s findings, the parties’ positions, or the documents’ historical filing status.