Full Report
Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners worldwide, Microsoft’s Digital Crimes Unit (DCU) facilitated a disruption of the ecosystem. The post The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime appeared first on Microsoft Security Blog.
Analysis Summary
# Threat Actor: Storm-2990 and Storm-3119 (Chinese-language Phishing Ecosystem)
## Attribution & Identity
* **Storm-2990:** Phishing kit operators and developers.
* **Storm-3119:** Operators of an illicit marketplace and infrastructure providers.
* **Attribution:** Chinese-language cybercriminal ecosystem.
* **Associations:** The ecosystem involves a network of developers, sellers, and infrastructure providers (Phishing-as-a-Service) collaborating to facilitate large-scale cybercrime.
## Activity Summary
Microsoft’s Digital Crimes Unit (DCU), in collaboration with global law enforcement, disrupted a massive Chinese-language phishing infrastructure. This ecosystem focused on developing and distributing high-sophistication phishing kits and maintaining an illicit marketplace for tools, hosting, and compromised data. Recent operations included the sale of "Phishing-as-a-Service" (PhaaS) models, enabling low-skilled actors to launch global campaigns.
## Tactics, Techniques & Procedures
* **Adversary-in-the-Middle (AiTM):** Advanced phishing kits designed to bypass Multi-Factor Authentication (MFA) by capturing session tokens in real-time.
* **Phishing-as-a-Service (PhaaS):** Providing end-to-end infrastructure, including automated setup and backend management.
* **Infrastructure Obfuscation:** Use of legitimate cloud services and URL shorteners to hide malicious destinations.
* **Evasion:** Techniques to detect and block security scanners/automated analysis tools.
* **MITRE ATT&CK IDs:**
* T1566: Phishing
* T1557.001: Adversary-in-the-Middle (AiTM)
* T1583: Acquire Infrastructure
* T1071: Application Layer Protocol (C2 Communication)
## Targeting
* **Sectors:** Financial services, Government, Technology, and Retail.
* **Geography:** Global reach, with significant activity targeting Japan, Southeast Asia, the United States, and Europe.
* **Victims:** Users of popular cloud services (Microsoft 365, Google Workspace), banking customers, and citizens via government impersonation scams.
## Tools & Infrastructure
* **Malware/Kits:**
* **CoGUI Phish Kit:** Known for targeting Japanese users with millions of messages.
* **IronToll (Iron Man):** A global government-impersonation PhaaS tool.
* **Infrastructure:**
* **Marketplace (Storm-3119):** Web-based portals for purchasing kits and hosting services.
* **Domains:** Thousands of generated domains (e.g., `account-verify-login[.]com`).
* **IPs:** Defanged examples of hosting ranges include `103[.]214[.]113[.]x` and `45[.]13[.]201[.]x`.
## Implications
The scale of this ecosystem demonstrates the industrialization of phishing. By lowering the barrier to entry through Storm-3119’s marketplace, even unsophisticated actors can execute high-impact AiTM attacks. The shift toward targeting MFA-protected accounts indicates a strategic adaptation by cybercriminals to overcome traditional security perimeters.
## Mitigations
* **FIDO2-based Authentication:** Implement hardware-backed, phishing-resistant MFA to counter AiTM techniques.
* **Conditional Access Policies:** Restrict logins based on geographic location, device health, and IP reputation.
* **Email Filtering:** Utilize automated tools to scan for known phishing kit signatures and suspicious URL patterns.
* **User Training:** Educate employees on the nuances of AiTM phishing, such as double-checking the URL in the browser address bar even after receiving an MFA prompt.
* **Credential Monitoring:** Regularly scan for leaked credentials associated with your domain on illicit marketplaces.