Coverage from Bleeping Computer indicates that a significant cybercriminal operation, responsible for over a billion malicious messages and targeting more than 75,000 organizations globally, has been dismantled by international law enforcement agencies and partners. This operation, identified as a sprawling Chinese-language marketplace, provided tools and services for extensive phishing campaigns.
The investigation, initiated by Microsoft and Japan's National Police Agency, uncovered the YAM Store (Storm-3119) marketplace, which sold compromised Microsoft and Google environments, accounts, and licenses. Operators used AI tools to create fake organizations and acquired expired domains to appear legitimate, hosting malicious content on compromised SharePoint and OneDrive storage. Phishing kits like CoGUI and Iron Man System (Storm-2990) offered various lures, including fake invoices and account verification requests, with features to evade security analysis. The Iron Man kit, in particular, offered over 2,300 templates impersonating banks, retailers, and government agencies. These platforms delivered more than 750 million messages, many using device-code phishing to steal authentication tokens. Law enforcement, including the U.S. District Court for the Southern District of Florida, seized domains, deactivated over 20,000 accounts, and blocked 100,000 domains associated with the YAM Store and its associated phishing kits, significantly disrupting the cybercrime ecosystem.
Source: Bleeping Computer
