MICROSOFT and Health-ISAC, with the JC3 and a coalition including Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs, have disrupted three Chinese-language phishing kits: CoGUI (also known as NX or FA), Haozi (Phoenix) and Iron Man System.
In a court‑authorised operation that began after Japan‑targeted campaigns were flagged in late 2025, the group is said to have facilitated the sending of more than one billion phishing emails and SMS messages to upwards of 75,000 organisations across more than 150 countries since January 2026, according to Microsoft Threat Intelligence and the Microsoft Digital Crimes Unit.
Investigators attribute the campaigns to an underground ecosystem around a marketplace codenamed YAM Store, with Storm-3119 tracking the broader network and Storm-2990 tied to the kit developers. Evidence points to overlapping capabilities and infrastructure among the three kits, suggesting shared origins or close collaboration among Chinese-speaking operators.
The kits impersonated government, financial and logistics brands worldwide, targeting consumers and organisations in healthcare, finance, wholesale distribution and IT sectors in Japan, the United States, Australia and India, among others. The operation also highlighted a cybercrime service economy in which compromised cloud environments and licensing servers underpin large‑scale phishing operations, with YAM Store advertising infrastructure and accepting cryptocurrency payments to conceal activity.
The kits’ tradecraft included automated reconnaissance for expired environments, broad Microsoft Graph permissions, bulk hosting via compromised tenants, automated storefronts for resold hijacked accounts and storage, and phishing templates spanning thousands of domains. Iron Man System, for example, boasted more than 2,335 templates targeting 139 countries and used WebSockets to stream stolen data in real time, with evasion techniques such as fake CAPTCHA gates and Telegram alerts.
Defenders’ actions are focused on sinkholing or disabling the licensing infrastructure to blunt the operators’ ability to deploy active campaigns. The disruption is described by Microsoft as a step toward weakening the larger service economy behind transnational cybercrime.