Full Report
Microsoft and Health-ISAC, along with the Japan Cybercrime Control Center (JC3) and a coalition of private sector companies, such as Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs, announced the disruption of three phishing kits, CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System. "Since January 2026, the threat actors behind these kits have been responsible for
Analysis Summary
# Incident Report: Disruption of Global Phishing-as-a-Service Ecosystem (Storm-2990 & Storm-3119)
## Executive Summary
A global coalition led by Microsoft, Health-ISAC, and JC3 disrupted a sophisticated Chinese-language phishing ecosystem involving three major kits: CoGUI, Haozi, and Iron Man System. Since January 2026, these operations facilitated over one billion scam messages targeting 75,000+ organizations across 150 countries. The disruption dismantled a complex supply chain involving the YAM Store marketplace, which resold compromised Microsoft and Google cloud environments to power large-scale financial fraud.
## Incident Details
- **Discovery Date:** Late 2025
- **Incident Date:** October 2024 (Earliest activity) – October 2026 (Disruption)
- **Affected Organization:** 75,000+ organizations (including Microsoft and Google tenant environments)
- **Sector:** Healthcare, Financial Services, Wholesale Distribution, and IT
- **Geography:** Global (Primary focus on Japan, U.S., Australia, and India)
## Timeline of Events
### Initial Access
- **Date/Time:** October 2024 (CoGUI initial appearance); June 2026 (Iron Man System launch)
- **Vector:** Credential theft and abuse of compromised cloud tenants.
- **Details:** Threat actors used automated tools to identify expired or vulnerable Microsoft 365 tenants to hijack for infrastructure.
### Lateral Movement
- **Details:** Once a tenant was compromised, actors granted themselves broad Microsoft Graph permissions and full control over SharePoint APIs to facilitate hosting and distribution.
### Data Exfiltration/Impact
- **Details:** Over one billion phishing emails/SMS sent; theft of sign-in credentials and financial data; tens of millions of dollars in illicit revenue generated.
### Detection & Response
- **Detection:** Microsoft launched an investigation in late 2025 following reports of malicious messaging in Japan.
- **Response Actions:** A court-authorized operation involving a private-sector coalition (Cloudflare, Proofpoint, etc.) to seize infrastructure and disrupt the YAM Store marketplace.
## Attack Methodology
- **Initial Access:** Hijacking of expired or fraudulently obtained Microsoft/Google cloud environments.
- **Persistence:** Implementation of app-only administrative panels (PHP, Java/Spring, Cloudflare Workers).
- **Privilege Escalation:** Abuse of Microsoft Graph and SharePoint APIs for full tenant control.
- **Defense Evasion:** Reconnaissance conducted anonymously via Tor infrastructure.
- **Credential Access:** Phishing kits (CoGUI, Haozi, Iron Man) used to steal user sign-in and financial data.
- **Discovery:** Automated profiling of cloud-enabled organizations and M365 tenant discovery.
- **Lateral Movement:** Not traditional network lateral movement; rather, moving across cloud services (SharePoint/OneDrive) within hijacked tenants.
- **Collection:** Bulk hosting of malicious content on hijacked SharePoint/OneDrive storage.
- **Exfiltration:** Use of the "YAM Store" (Storm-3119) to resell stolen accounts and licenses.
- **Impact:** Mass-scale phishing and financial fraud via Phishing-as-a-Service (PaaS).
## Impact Assessment
- **Financial:** Tens of millions of dollars generated for operators; significant loss to targeted consumers and institutions.
- **Data Breach:** Compromise of sign-in credentials for thousands of organizations; theft of sensitive financial data.
- **Operational:** High-volume abuse of corporate cloud resources (SharePoint/OneDrive) for hosting malware/phishing.
- **Reputational:** Impersonation of major brands including Amazon, Apple, Rakuten, and PayPay.
## Indicators of Compromise
- **Network indicators:** Activity originating from Tor exit nodes for reconnaissance; traffic to YAM Store infrastructure.
- **File indicators:** Phishing templates for Japanese financial and consumer brands (Amazon, PayPay, MyJCB).
- **Behavioral indicators:** Unauthorized creation of high-privilege Microsoft Graph API permissions; unusual bulk uploads to SharePoint/OneDrive.
## Response Actions
- **Containment:** Court-authorized seizure of domains and infrastructure associated with CoGUI, Haozi, and Iron Man kits.
- **Eradication:** Disruption of the YAM Store (Storm-3119) marketplace.
- **Recovery:** Notification to affected organizations and cleanup of compromised M365 tenants.
## Lessons Learned
- **Supply Chain of Fraud:** Modern phishing is a highly specialized "service economy" where developers, infrastructure brokers (IABs), and kit operators collaborate.
- **Cloud Governance:** The reuse of expired or poorly managed cloud tenants provides attackers with high-reputation infrastructure that bypasses standard email filters.
## Recommendations
- **Identity Security:** Enforce phishing-resistant Multi-Factor Authentication (MFA) to prevent credential theft.
- **Tenant Management:** Regularly audit Microsoft Graph and SharePoint API permissions for unauthorized third-party applications.
- **Infrastructure Monitoring:** Implement alerts for unusual administrative activity in cloud environments, especially those involving automated creation of storage or hosting services.