Microsoft and Partners Take Down Chinese-Language Phishing Kit Network Behind Over 1 Billion Scam Messages

Microsoft has announced the disruption of a large ecosystem of Chinese-language cybercrime tools and services, working with Japanese authorities, Health-ISAC and several cybersecurity companies. Since the start of the year, phishing kits developed and sold by a group Microsoft tracks as Storm-2990 have delivered more than 1 billion phishing emails and SMS messages to more than 75,000 organisations worldwide. More than three-quarters of those messages targeted Microsoft customers. Targets were mainly in healthcare, financial services, logistics and IT, predominantly in the United States and Japan.

Using a federal court order, Microsoft and Health-ISAC seized and redirected domains that powered the infrastructure behind three services known as YAM Store, CoGUI and Iron Man. Microsoft also disabled more than 20,000 accounts connected to YAM Store. It says it continues to disrupt the operation by removing infrastructure hosted on its services and blocking more than 100,000 domains used for impersonation and fraud.

Microsoft's Digital Crimes Unit noted that the lures are familiar: a package that cannot be delivered, an unpaid toll, a bank account needing attention or an overdue tax bill. The details change, but the goal is to get someone to click, share personal information or pay. As Steven Masada wrote, a simple scam message is often the visible end of a much larger transnational criminal operation.