Image: cyberscoop.com · rights & removal

Microsoft and partners disrupt vast Chinese

Reporting by CyberScoopRead the original at cyberscoop.com

Executive Summary

Microsoft collaborated with Japanese authorities, Health-ISAC, and various cybersecurity companies to dismantle an ecosystem of Chinese-language phishing tools and services. This investigation focused on a collection of customized phishing kits tracked by Microsoft as Storm-2990, which had distributed over one billion phishing emails and SMS messages to more than 75,000 global organizations since the start of the year. The malicious communications primarily targeted Microsoft customers. Cybercriminals used these tools and infrastructure, including services named YAM Store, CoGUI, and Iron Man, to target entities in healthcare, financial services, logistics, and IT, predominantly in the United States and Japan.
Microsoft and Health-ISAC seized and redirected domains related to this infrastructure under a federal court order. The company also disabled over 20,000 accounts connected to YAM Store and blocked over 100,000 domains used for impersonation and fraud. The phishing messages often prompted immediate action regarding unpaid bills or delivery issues, leading victims to share personal information or make payments. Researchers suggested the phishing kits shared development origins, indicating collaboration among developers. The investigation uncovered an underground service economy that supplied criminals with tools and infrastructure necessary to execute these large-scale scams.

Facts Only

* Microsoft collaborated with Japanese authorities, Health-ISAC, and cybersecurity companies.
* A cluster of phishing kits, tracked as Storm-2990, were developed and sold by Chinese-speaking threat actors since the start of the year.
* These kits delivered over one billion phishing emails and SMS messages to more than 75,000 global organizations.
* More than three-quarters of malicious messages targeted Microsoft customers.
* Cybercriminals purchased tools and infrastructure from an interconnected network investigated by Microsoft and Japanese authorities.
* The phishing activities targeted individuals and organizations in healthcare, financial services, logistics, and IT, mostly in the United States and Japan.
* Microsoft and Health-ISAC seized and redirected domains for YAM Store, CoGUI, and Iron Man infrastructure.
* Microsoft disabled over 20,000 accounts connected to YAM Store.
* More than 100,000 domains used for impersonation and fraud were blocked.
* Phishing kits were used to steal credentials, financial data, and exploit device code authentication.
* Researchers found 2,360 phishing templates impersonating various entities across 130 countries.

Full Take

The narrative reveals a structural shift where criminal activity transcends simple fraud; it forms an organized, cross-border service economy layered upon the initial scam. The focus on "YAM Store," "CoGUI," and "Iron Man" demonstrates that the immediate visible scams (package delivery alerts) are merely the surface layer of a larger supply chain enabling financial abuse through credential theft and fraudulent transactions. This suggests that disruption must target not just the end-user messages but the underlying infrastructure that enables mass impersonation across multiple sectors like finance and healthcare. The fact that researchers noted shared development origins implies an ecosystem where collaboration is inherent, turning individual malicious actions into industrial-scale operations. The operational imperative for disruption, as articulated by Microsoft’s leadership, shifts from mitigating individual attacks to dismantling these enabling infrastructures—the "businesses behind it"—to achieve systemic resilience. What is the responsibility when the visible harm is distributed across so many seemingly disparate entities? What accountability exists for the infrastructure that facilitates transnational financial crime? How can defensive efforts effectively address decentralized development patterns instead of just blocking domains?

From the original · CyberScoop

language phishing kit ecosystem Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and services, the company announced Wednesday.

Read the full story at cyberscoop.com