In a blog post, the tech firm said a group it nicknamed “Strontium” was using seven internet domains as part of an effort to spy on government bodies and think tanks in the EU and the United States, as well as Ukrainian institutions such as media organizations.
Microsoft did not identify any of the targets by name.
Strontium is Microsoft’s moniker for a group others often call Fancy Bear or APT28 – a hacking squad linked to Russia’s military intelligence agency.
The Russian Embassy in Washington did not immediately return a message seeking comment.
Ukraine has been buffeted by hacking attempts since Russian forces invaded the country in February.