MICROSOFT and Health-ISAC, acting under a US District Court for the Southern District of Florida order, disrupted a Chinese-language cybercrime marketplace that supplied phishing infrastructure to criminals. The authorities seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components identified as part of the marketplace, which Microsoft tracks as Storm-3119 and Storm-2990.
The operation followed alerts from Japan’s National Police Agency in late 2025 and involved collaborative input from Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs and other law‑enforcement partners. Health-ISAC’s involvement was prompted by the ecosystem’s frequent targeting of hospitals and healthcare organisations.
Microsoft says the services powered more than a billion malicious messages since January 2026, with victims comprising consumers and more than 75,000 organisations across over 150 countries, including more than 750 million Microsoft customers. The seizure disabled over 20,000 accounts linked to YAM Store and blocked more than 100,000 domains used for impersonation and fraud.
YAM Store functioned as an access broker that hijacked Microsoft 365 and Azure for Education tenants to resell stolen accounts, licences and storage to downstream operations, including phishing kits identified as Storm-2990 (CoGUI, Haozi and Iron Man). Iron Man, the latest kit, offered more than 2,335 templates across 139 countries, with templates largely impersonating transportation and government entities; it operates as a live credential-harvesting platform requiring regular contact with a licensing server.
Independent researchers who evaluated Iron Man noted a dependency on the vendor’s infrastructure, meaning sinkholing the licensing host could degrade all active deployments.