Microsoft and Partners Disrupt Chinese-Language Phishing Kit Ecosystem

Microsoft and a group of partners have dismantled a sprawling ecosystem of Chinese-language cybercrime tools and services responsible for delivering more than 1 billion phishing emails and SMS messages to over 75,000 organizations worldwide since the start of the year. The company announced the disruption on Wednesday after working alongside Japanese authorities, Health-ISAC and several cybersecurity companies.

Takedown of YAM Store, CoGUI and Iron Man

Microsoft said the customized phishing kits were developed and sold by Chinese-speaking threat actors in a cluster the company tracks as Storm-2990. More than three-quarters of the malicious messages targeted Microsoft customers. The kits were used to hit individuals and organizations in healthcare, financial services, logistics and IT, predominantly in the United States and Japan.

Using a federal court order, Microsoft and Health-ISAC seized and redirected domains powering the underlying infrastructure of the services known as YAM Store, CoGUI and Iron Man. The company also disabled more than 20,000 accounts connected to YAM Store and said it continues to disrupt the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.

Stolen credentials and financial fraud

The phishing kits included templates impersonating legitimate brands, which cybercriminals used to run high-volume campaigns. Researchers said similar infrastructure and overlapping activity suggested the tools shared development origins, code reuse or close collaboration among developers.

Cybercriminals used the kits to steal credentials and financial data, and to abuse the device code authentication process to obtain authentication tokens and access compromised accounts. The tools were primarily used for financial fraud, typically involving stolen payment data for fraudulent purchases of high-end goods or transactions on legitimate financial platforms.

An underground service economy

Resecurity, which aided the investigation, gained access to Iron Man's infrastructure and found 2,360 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries. Cloudflare, Oracle, Proofpoint and TRM Labs also provided research and investigative support.

Steven Masada, general counsel and general manager of Microsoft's Digital Crimes Unit, said the work began with scam activity targeting people and organizations in Japan and led investigators to an underground service economy supplying criminals around the world. He said disrupting YAM Store, CoGUI and Iron Man makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on.

Sources: Cyberscoop · The Record · Securityweek