Microsoft, Health-ISAC, Japanese authorities, and others disrupt a Chinese-language phishing kit ecosystem used to send 1B+ messages to 75K+ orgs this year

The disruption of YAM Store, CoGUI, and Iron Man makes it harder for criminals to obtain the tools and infrastructure they rely on for cybercrime.

Microsoft, alongside Japanese authorities and cybersecurity partners like Health-ISAC, has dismantled a large Chinese-language phishing kit ecosystem. This operation, tracked as Storm-2990, involved customized tools and services sold on platforms like YAM Store, CoGUI, and Iron Man. In under ten months, these kits facilitated over one billion phishing messages and SMS messages targeting more than 75,000 organizations globally. The primary targets were Microsoft customers, with healthcare, financial services, and logistics sectors in the US and Japan being heavily impacted. The disruption involved seizing domains, disabling over 20,000 accounts, and blocking more than 100,000 malicious domains. These phishing kits were used to steal credentials, financial data, and authentication tokens, leading to financial fraud through fraudulent purchases and transactions.

The coordinated takedown highlights the growing sophistication and interconnectedness of transnational cybercrime operations, particularly those originating from Chinese-speaking threat actors. The sheer volume of messages and the number of affected organizations underscore the pervasive nature of these threats and the need for ongoing, multi-jurisdictional collaboration to combat them effectively. The focus on sectors like healthcare and finance indicates these industries remain prime targets due to the sensitive data they hold, making robust security measures and rapid incident response critical.

This action by Microsoft and its partners signals an increasing willingness and capability of major tech companies to actively police the digital underground and disrupt criminal enterprises. The availability of customized phishing kits as a service is a significant market trend, enabling lower-skilled actors to launch high-impact attacks. Continued efforts to dismantle these marketplaces and their supporting infrastructure will be key in mitigating the widespread financial and data security risks faced by organizations worldwide.