Law enforcement and tech giants have dismantled a sprawling criminal marketplace functioning essentially as an illegal app store for cybercriminals. Microsoft announced a collaborative operation alongside the Japanese National Police Agency that targeted Chinese-language cybercrime operations known as the YAM Store, CoGUI, and Iron Man. These platforms have been tied to over a billion malicious communications sent to targets across more than 150 countries, impacting roughly 75,000 organizations worldwide.
The international effort also involved major security and infrastructure firms including Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs. Investigators uncovered that the criminal ecosystem provided aspiring fraudsters with pre-fabricated phishing websites, impersonation templates for major brands like Amazon, financial institutions, and government agencies, as well as ready-to-use accounts. The CoGUI phishing-as-a-service framework notably utilized advanced evasion tactics such as browser fingerprinting and geofencing to bypass standard security filters.
Microsoft designated the marketplace tracked under the moniker Storm-3119, operating primarily as an Initial Access Broker. The YAM Store utilized automated scripts to locate expired organization and environment names, allowing operators to leverage legitimate customer information and continuously refresh their inventory while evading traditional security detections. As a result of the coordinated takedown, authorities have successfully seized, blocked, or redirected the malicious domains tied to the YAM, CoGUI, and Iron Man infrastructure.
Comments