Full Report
In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally. The post Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem appeared first on CyberScoop.
Analysis Summary
# Incident Report: Disruption of Storm-2990 Phishing Ecosystem
## Executive Summary
Microsoft, in collaboration with international law enforcement and private sector partners, dismantled a massive Chinese-language phishing-as-a-service ecosystem tracked as Storm-2990. Over a 10-month period, this network facilitated the transmission of over 1 billion malicious messages to 75,000 organizations globally. The operation resulted in the seizure of core infrastructure and the disabling of tens of thousands of accounts used for large-scale credential theft and financial fraud.
## Incident Details
- **Discovery Date:** Early 2025
- **Incident Date:** January 2026 – October 2026
- **Affected Organization:** 75,000+ organizations globally (75% were Microsoft customers)
- **Sector:** Healthcare, Financial Services, Logistics, and IT
- **Geography:** Global, with a primary focus on the United States and Japan
## Timeline of Events
### Initial Access
- **Date/Time:** Commenced early 2026
- **Vector:** Phishing (Email and SMS/Smishing)
- **Details:** Attackers used customized kits to send urgent, fraudulent alerts regarding package deliveries, unpaid tolls, bank account issues, and overdue taxes.
### Lateral Movement
- **Details:** The primary goal was account takeover. Attackers abused the device code authentication process to obtain authentication tokens, allowing them to bypass security measures and move into compromised cloud environments.
### Data Exfiltration/Impact
- **Details:** Theft of user credentials and sensitive financial data. Stolen payment information was primarily used for fraudulent purchases of high-end goods and illicit transactions on financial platforms.
### Detection & Response
- **Detection:** Initial investigation began in early 2025 by Microsoft and Japanese authorities following scam activity targeting Japanese citizens.
- **Response Actions:** A federal court order allowed for the seizure and redirection of infrastructure domains. Microsoft and partners disabled over 20,000 accounts and blocked 100,000+ fraudulent domains.
## Attack Methodology
- **Initial Access:** High-volume Phishing and Smishing.
- **Persistence:** Utilization of stolen authentication tokens to maintain access to cloud accounts.
- **Privilege Escalation:** Not explicitly detailed, but involved obtaining administrative-level access through credential theft.
- **Defense Evasion:** Use of 2,360+ distinct phishing templates and a vast network of rotating domains to avoid blocklists.
- **Credential Access:** Theft of login credentials and session tokens via "Iron Man," "CoGUI," and "YAM Store" kits.
- **Discovery:** Reconnaissance of brands (banks, retailers, police, government) to create convincing impersonation templates.
- **Lateral Movement:** Token theft and session hijacking.
- **Collection:** Automated gathering of financial data and personal identifiable information (PII).
- **Exfiltration:** Direct use of stolen data for financial fraud.
- **Impact:** Financial loss and unauthorized access to 75,000+ organizations.
## Impact Assessment
- **Financial:** Extensive; used for high-end goods fraud and platform-based financial crimes.
- **Data Breach:** Massive volume of credentials and payment data stolen across 130 countries.
- **Operational:** Disruption to IT services and package delivery/logistics workflows due to impersonation.
- **Reputational:** Impersonation of trusted brands including healthcare providers and government agencies.
## Indicators of Compromise
- **Network Indicators:**
- YAM Store infrastructure domains [defanged]
- CoGUI infrastructure domains [defanged]
- Iron Man phishing kit domains [defanged]
- Over 100,000 impersonation domains [defanged]
- **File Indicators:** Chinese-language phishing kit source code; customized templates for retailers/banks.
- **Behavioral Indicators:** Abnormal device code authentication requests; high-volume SMS/Email blasts from new or hijacked infrastructure.
## Response Actions
- **Containment:** Domain seizure via federal court order to redirect malicious traffic.
- **Eradication:** Removal of infrastructure hosted on Microsoft services; disabling of 20,000+ malicious accounts.
- **Recovery:** Blocking of 100,000+ fraudulent domains; ongoing monitoring by Microsoft Digital Crimes Unit and Health-ISAC.
## Lessons Learned
- **Key Takeaways:** Cybercrime is increasingly moving toward a highly specialized "service economy" where developers sell kits to diverse threat actors.
- **Collaboration:** Successful disruption requires cross-border cooperation between private tech firms, international law enforcement (Japan), and sector-specific groups (Health-ISAC).
## Recommendations
- **MFA Hardening:** Transition from traditional SMS/Email MFA to phishing-resistant hardware keys or FIDO2 standards to prevent device code/token theft.
- **Brand Protection:** Organizations should implement DMARC/DKIM/SPF and monitor for domain typosquatting.
- **User Education:** Train employees to recognize the specific "urgency" tactics used in smishing (package/toll/tax alerts).