Microsoft and Partners Disrupt Chinese-Language Phishing Kit Network

Summary

Microsoft and partners, including Japanese authorities, disrupted phishing-kit services linked to more than 1 billion messages targeting over 75,000 organizations since the start of the year. Microsoft seized domains, disabled accounts and blocked impersonation sites.

Key points

• Microsoft tracks the Chinese-speaking threat actor cluster behind the kits as Storm-2990.
• The phishing campaigns targeted organizations in healthcare, financial services, logistics and IT, primarily in the U.S. and Japan.
• The kits were used to steal credentials and financial data, and to abuse device-code authentication to obtain tokens and access accounts.
• Microsoft and Health-ISAC seized and redirected domains supporting YAM Store, CoGUI and Iron Man under a federal court order.
• Microsoft disabled more than 20,000 YAM Store-linked accounts and said it continues removing hosted infrastructure and blocking domains used for impersonation and fraud.
• Resecurity found 2,360 phishing templates impersonating organizations across 130 countries.

People

Threat Actors

Vendors

Countries

Industries