Microsoft (NASDAQ:MSFT) said on Thursday it had disrupted hacking attempts by Russian military spies aimed at breaking into Ukrainian, European Union, and American targets.

Microsoft Corporate Vice President Tom Burt said the group, known as Strontium that it has “tracked for years,” was trying to take control of seven internet domains to coordinate the attacks. Microsoft obtained a court order to take control of the domains “to mitigate Strontium’s current use of these domains and enable victim notifications,”

In addition to going after organizations in Ukraine, Strontium, which Microsoft called a “Russian GRU-connected actor,” was also targeting government institutions and think tanks in the U.S. and European Union. Strontium is also known as Fancy Bear or APT28 and is often linked to Russian intelligence. Microsoft added that prior to this week’s action, it has seized control

Microsoft did not identify any of the targets by name.

Strontium is Microsoft’s moniker for a group others often call Fancy Bear or APT28 – a hacking squad linked to Russia’s military intelligence agency.

The Russian Embassy in Washington did not immediately return a message seeking comment.

Ukraine has been buffeted by hacking attempts since Russian forces invaded the country in February.

MSFT shares gave up $3.11, or 1%, Friday morning to $298.26.