Disruption of Chinese Phishing Kit Ecosystem: Storm-2990 & YAM Store

Microsoft’s Digital Crimes Unit (DCU) has dismantled a Chinese‑language phishing kit ecosystem that operated under the code names Storm‑2990 (developers) and Storm‑3119 (YAM Store marketplace). The network sold three phishing kits—CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System—to threat actors who used them to send more than 1 billion phishing emails and SMS messages.

Microsoft’s research uncovered the ecosystem, revealing a coordinated supply chain of kit developers, infrastructure dealers, and end‑user threat actors.

Impact

• Targeted over 75 000 organizations worldwide, primarily in healthcare, financial services, wholesale distribution, and IT.
• Attacks originated from Japan, the United States, Australia, and India.
• Phishing kits leveraged compromised or fraudulent Microsoft and Google cloud environments.

Mitigation & Detection

• Block known phishing kit domains and IP ranges identified by Microsoft Defender.
• Enable Microsoft Defender for Office 365 and Microsoft Defender for Endpoint to detect and block kit‑related URLs.
• Inspect cloud environments for unauthorized access and validate credentials against known compromised lists.
• Apply the latest Microsoft Defender threat intelligence feeds to update firewall and DNS filtering rules.

Next Steps for Defenders

• Review email and SMS logs for large volumes of outbound messages matching known kit signatures.
• Conduct a threat hunting exercise focused on the three kit families (CoGUI, Haozi, Iron Man System).
• Coordinate with law enforcement if you identify infrastructure linked to Storm‑2990 or Storm‑3119.
• Share indicators of compromise with Microsoft’s threat intelligence community.