Actor Profile

CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System are three interconnected phishing-as-a-service (PhaaS) kits operated within the Chinese-language cybercriminal ecosystem. Microsoft tracks the developers behind all three kits as Storm-2990 and the underground marketplace distributing them (YAM Store) as Storm-3119. Evidence indicates shared development origins, code reuse, or close collaboration among Chinese-speaking developers. These kits have been advertised and sold through YAM Store since late 2024, with Iron Man System emerging in June 2026 as a successor to CoGUI. The operators are financially motivated, generating tens of millions of dollars by facilitating credential theft and financial fraud through high-volume phishing campaigns. YAM Store functions as both a phishing kit marketplace and initial access broker (IAB), selling compromised or fraudulently obtained Microsoft and Google cloud environments alongside the kits themselves, accepting payment in cryptocurrency (USDT, Ethereum) to conceal illicit activity.

TTPs (Tactics, Techniques, Procedures)

The phishing kits and their distribution infrastructure (Storm-3119/YAM Store) employ sophisticated TTPs spanning reconnaissance, resource development, and credential access. Initial Access: T1566.001 (Spearphishing Attachment) and T1566.002 (Spearphishing Link) via over 1 billion phishing emails and SMS messages. Reconnaissance: T1589 (Gather Victim Identity Information) and T1592 (Gather Victim Host Information) using automation to profile cloud-enabled organizations, identify expired Microsoft 365 tenants, and discover viable environments anonymously through Tor infrastructure. Resource Development: T1583.001 (Acquire Infrastructure: Domains) with approximately 17,000 unique domains used across the three kits; T1586 (Compromise Accounts) by taking over expired or compromised Microsoft/Google cloud environments; T1587.001 (Develop Capabilities: Malware) with 2,335+ phishing templates impersonating brands across 139 countries. Persistence: T1098 (Account Manipulation) by granting broad Microsoft Graph permissions and full SharePoint API control within compromised tenants. Defense Evasion: T1562 (Impair Defenses) using fake CAPTCHA gates, IP-based allow/block lists, geofencing to restrict phishing content to specific countries, and licensing server dependencies. Collection: T1056.003 (Input Capture: Web Portal Capture) via phishing pages; real-time credential harvesting using WebSocket connections. Command and Control: T1102 (Web Service) abusing compromised SharePoint and OneDrive for bulk hosting; Telegram-based alerts (T1102.002) notifying operators when victims interact with lures. Impact: T1657 (Financial Theft) targeting credentials and financial data from consumer, healthcare, and financial institutions.

Targets & Patterns

The three phishing kits have targeted over 75,000 organizations across more than 150 countries since January 2026, with primary focus on Japan, the United States, Australia, and India. Targeted sectors include healthcare organizations, financial institutions, wholesale distribution, information technology, government agencies, and logistics. The kits feature 2,335-2,360 phishing templates impersonating trusted brands across consumer services (Amazon, Apple), financial services (PayPay, MyJCB, Orico, Rakuten), postal services, tax agencies, telecommunications, and loyalty programs. CoGUI specifically targeted Japanese organizations starting in October 2024, impersonating well-known Japanese consumer and finance brands. The broad targeting pattern reflects the PhaaS business model: kit operators provide turnkey infrastructure and templates, while customers (threat actors who purchase the kits) select their specific victims. The geographic and sectoral diversity suggests the kits are designed for maximum flexibility, allowing purchasers to conduct localized campaigns with region-specific brand impersonation. Healthcare emerged as a significant target, prompting Health-ISAC involvement in the disruption operation.

Historical Context

CoGUI has been observed in real-world campaigns since at least October 2024, with Proofpoint documenting its operations targeting Japanese organizations in May 2025. The kit spawned two closely related variants: CoAceV and CoFish_Ws. Microsoft launched its investigation in late 2025 after notification of malicious messaging campaigns targeting people in Japan. By mid-2026, CoGUI was being increasingly replaced by Iron Man System, which was first advertised through YAM Store in June 2026. Resecurity identified a self-hosted Git and container-registry server containing 911 builds of the Iron Man System admin panel spanning October 2025 through June 2026, indicating continuous development and iteration. The disruption operation announced in October 2026 was court-authorized and resulted from collaboration between Microsoft Threat Intelligence, Microsoft Digital Crimes Unit, Health-ISAC, Japan Cybercrime Control Center (JC3), and private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. This represents a significant public-private partnership targeting the Chinese-language cybercriminal PhaaS ecosystem.

Defensive Recommendations

  • Monitor for anomalous Microsoft Graph API permissions and SharePoint API access patterns, particularly broad permissions granted to newly created or external applications (T1098)
  • Implement network monitoring for Tor exit node connections conducting reconnaissance against Microsoft 365 tenant enumeration endpoints (T1589, T1592)
  • Deploy email security controls to detect high-volume phishing campaigns using CAPTCHA gates and geofencing techniques; correlate with threat intelligence on the 17,000+ known phishing domains
  • Monitor for WebSocket connections from corporate endpoints to external domains, which may indicate real-time credential harvesting (T1056.003)
  • Audit cloud tenant configurations for expired or dormant Microsoft 365 and Google Workspace environments that could be hijacked; implement automated alerts for unauthorized administrative panel deployments (PHP, Java/Spring, Cloudflare Workers)
  • Establish detection for Telegram bot API traffic from enterprise networks, which may indicate compromise notification channels used by phishing kit operators (T1102.002)

---

# Geopolitical Context

Geopolitical Context

The disruption of three interconnected phishing kits—CoGUI, Haozi, and Iron Man System—reveals the maturation of Chinese-language cybercriminal ecosystems operating as sophisticated phishing-as-a-service platforms. The operation, coordinated by Microsoft, Health-ISAC, Japan's JC3, and private sector partners, targeted infrastructure linked to Storm-3119 (YAM Store marketplace) and Storm-2990 (kit developers). Since January 2026, these kits facilitated over one billion phishing messages targeting 75,000 organizations across 150+ countries, with particular focus on Japan, the United States, Australia, and India. The ecosystem demonstrates advanced tradecraft including automated reconnaissance via Tor, abuse of compromised Microsoft and Google cloud tenants, and cryptocurrency-based payment rails (USDT, Ethereum) to obscure financial flows. The Chinese-language nature of the developer community, combined with targeting patterns and operational security measures, suggests a transnational criminal network operating with relative impunity, though no direct state sponsorship is indicated in available reporting.

State Actor Alignment

No state actor attribution is provided in the reporting. The threat actors are characterized as Chinese-speaking cybercriminals operating within a commercialized underground marketplace ecosystem. While the language and infrastructure suggest operations originating from or linked to Chinese-speaking regions, there is no evidence presented of state direction or sponsorship. The disruption involved court-authorized action, indicating law enforcement cooperation, though specific jurisdictional details beyond Japan's JC3 participation are not disclosed. The use of cryptocurrency payment systems and Tor infrastructure reflects efforts to evade attribution and financial tracking. The targeting of Japanese organizations and the involvement of JC3 may indicate investigative interest from Japanese authorities, but no sanctions designations or formal government attributions have been announced in connection with this operation.

Business Impacty pro region

The global scope of this phishing infrastructure—spanning 150+ countries with 17,000 domains and 2,335+ phishing templates—demonstrates the borderless nature of contemporary cybercrime. Japan emerges as both a primary target and a key partner in the disruption effort, with JC3's involvement reflecting Tokyo's growing role in regional cyber defense coordination. The targeting of healthcare, financial services, and IT sectors in Japan, the United States, Australia, and India suggests threat actors prioritized high-value economies within the Indo-Pacific and Western markets. For Europe, the operation underscores the transnational reach of Chinese-language cybercriminal ecosystems, which increasingly rival Russian-language forums in scale and sophistication. The public-private coalition model—involving Microsoft, Cloudflare, Oracle, Proofpoint, and others—reflects an emerging norm of cross-border, multi-stakeholder disruption operations that may inform future European approaches to combating phishing-as-a-service platforms. The reliance on compromised cloud infrastructure from major U.S. providers (Microsoft, Google) highlights persistent challenges in securing legitimate platforms against abuse by sophisticated criminal actors.

Forecast

If the licensing server dependencies identified by Resecurity are successfully sinkholed or disabled, active deployments of Iron Man System are likely to degrade significantly in the near term, potentially forcing operators to seek alternative kits or rebuild infrastructure. However, if the underlying developer community (Storm-2990) and marketplace operators (Storm-3119) remain at large, reconstitution of similar phishing-as-a-service capabilities is probable within months, potentially under new branding or with modified licensing architectures. Should Japanese or U.S. authorities pursue criminal prosecutions or extraditions related to this infrastructure, deterrent effects may materialize within Chinese-language cybercriminal forums, though enforcement challenges across jurisdictions are likely to limit impact. If the public-private coalition model proves effective in this case, similar coordinated disruptions targeting other PhaaS ecosystems may increase in frequency, particularly against platforms abusing major cloud providers. Organizations in targeted sectors—especially healthcare, finance, and logistics—should anticipate continued phishing pressure as threat actors migrate to alternative kits or develop successor platforms with enhanced evasion capabilities.