Actor Profile

Storm-2990 and Storm-3119 represent two interconnected Chinese-language cybercriminal entities operating a large-scale phishing ecosystem. Storm-2990 is a cluster of phishing kit developers responsible for three major kits: CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. Storm-3119 operates YAM Store, an initial access broker (IAB) and illicit marketplace selling compromised or fraudulently obtained Microsoft and Google cloud environments. Since January 2024, Storm-2990 has facilitated over one billion phishing emails and SMS messages targeting 75,000+ organizations worldwide. The actors monetize operations through cryptocurrency (USDT, Ethereum) and maintain Telegram-based sales channels. Microsoft assesses with high confidence these are Chinese-speaking threat actors exhibiting shared development origins, code reuse, or close collaboration. Microsoft's Digital Crimes Unit collaborated with law enforcement to disrupt this ecosystem's primary developers and infrastructure.

TTPs (Tactics, Techniques, Procedures)

Storm-3119 employs a five-stage attack pipeline: (1) Reconnaissance using Flask-based Python tooling over Tor infrastructure to identify Microsoft 365 tenants and assess enrollment opportunities; (2) Environment takeover of expired or legitimate organization credentials; (3) Automated provisioning of fraudulent cloud environments; (4) Monetization through YAM Store marketplace; (5) Distribution to downstream actors. Storm-2990 phishing kits provide templates impersonating government, financial, and logistics brands, enabling high-volume credential theft operations. The ecosystem leverages compromised Microsoft 365 and Azure for Education tenants, fraudulently obtained .edu and .org domains, and legitimate customer information to circumvent detection. Infrastructure is sold based on age, subscription type, and environment legitimacy to lower barriers for less-skilled cybercriminals.

Targets & Patterns

The ecosystem targets organizations across healthcare, financial services, wholesale distribution, and information technology sectors. Geographic focus includes Japan, United States, Australia, and India, with over 75,000 organizations impacted globally. Storm-3119 specifically targets expired Microsoft 365 and Azure for Education tenants, leveraging legitimate organization numbers and customer information. The phishing kits sold through YAM Store enable downstream threat actors to impersonate government agencies, financial institutions, and logistics companies worldwide. The targeting pattern reflects opportunistic infrastructure acquisition combined with sector-specific phishing templates designed for credential harvesting at scale. The focus on education environments (.edu) and non-profit domains (.org) suggests exploitation of trusted institutional infrastructure to enhance phishing campaign legitimacy.

Historical Context

Microsoft's investigation began with research into a single phishing kit that unraveled the larger Storm-2990/Storm-3119 ecosystem. The three phishing kits (CoGUI, Haozi, Iron Man System) were advertised sequentially through YAM Store, with CoGUI and Haozi appearing first, followed by Iron Man System starting in June 2024. Microsoft collaborated with industry partner Resecurity to identify and analyze these kits. The similarity in infrastructure, capabilities, and functionality across all three kits suggests either shared development origins, code reuse, or close collaboration among developers despite distinct branding and separate Telegram sales channels. Since January 2024, the ecosystem has been responsible for facilitating over one billion phishing emails and SMS messages. Microsoft's Digital Crimes Unit facilitated disruption of the ecosystem's primary developers and infrastructure in collaboration with law enforcement agencies and partners worldwide.

Defensive Recommendations

  • Monitor for anomalous Microsoft 365 and Azure tenant enrollment activity, particularly targeting expired or dormant education (.edu) and non-profit (.org) environments
  • Implement conditional access policies restricting sign-ins from Tor exit nodes and anonymization infrastructure commonly used in reconnaissance phases
  • Deploy email authentication protocols (SPF, DKIM, DMARC) with strict enforcement to detect phishing emails originating from fraudulently provisioned cloud environments
  • Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments to detect and block phishing kit templates impersonating government, financial, and logistics brands
  • Monitor for Flask-based Python reconnaissance tooling attempting to enumerate cloud tenant information and licensing details through automated queries

---

# Geopolitical Context

Geopolitical Context

Microsoft's Digital Crimes Unit, in collaboration with international law enforcement, disrupted a sophisticated Chinese-language cybercriminal ecosystem comprising phishing kit developers (Storm-2990) and an illicit marketplace (Storm-3119, "YAM Store"). The ecosystem facilitated over one billion phishing messages targeting 75,000 organizations globally since early 2024, primarily affecting Japan, the United States, Australia, and India across healthcare, financial services, wholesale distribution, and IT sectors. The operation represents a significant example of commercialized cybercrime infrastructure that lowers barriers to entry for less sophisticated actors. While Microsoft assesses with high confidence that the developers are Chinese-speaking, the investigation focuses on criminal activity rather than state-sponsored operations. The use of cryptocurrency (USDT, Ethereum) for payments and Tor infrastructure for anonymity reflects standard cybercriminal tradecraft designed to evade attribution and enforcement.

State Actor Alignment

The activity appears to be financially motivated cybercrime rather than state-sponsored espionage. Microsoft attributes the ecosystem to Chinese-speaking threat actors based on language analysis and operational characteristics, but no direct links to Chinese state entities are indicated in the available information. The disruption involved collaboration between Microsoft's Digital Crimes Unit and international law enforcement agencies, suggesting a coordinated private sector-government response to transnational cybercrime. The targeting pattern—spanning democratic allies including Japan, the United States, and Australia—and the commercial nature of the infrastructure marketplace are consistent with profit-driven criminal enterprise rather than strategic intelligence collection. The use of fraudulently obtained cloud environments from major Western providers (Microsoft, Google) to enable downstream phishing operations represents a supply-chain approach to cybercrime that complicates traditional enforcement and attribution frameworks.

Business Impacty pro region

The disruption has significant implications for the Asia-Pacific region and global cybersecurity posture. Japan emerged as the most heavily impacted nation, followed by the United States, Australia, and India—suggesting either targeting preferences or vulnerability concentrations in these markets. The ecosystem's ability to operate at scale (one billion phishing messages) demonstrates how commercialized criminal infrastructure can amplify threat actor capabilities regardless of technical sophistication. For Europe, while not explicitly mentioned as a primary target region, the precedent of Chinese-language criminal ecosystems operating globally warrants heightened vigilance, particularly given the ecosystem's targeting of financial services and healthcare sectors subject to GDPR and NIS2 requirements. The successful public-private disruption model—combining Microsoft's threat intelligence with international law enforcement action—may inform future counter-cybercrime strategies. However, the use of cryptocurrency and anonymization technologies suggests that attribution and enforcement remain challenging, particularly when criminal infrastructure spans multiple jurisdictions and leverages legitimate cloud providers.

Forecast

If the disruption successfully dismantled core infrastructure and arrested key operators, a temporary reduction in phishing volume from this specific ecosystem is likely over the coming weeks to months. However, if only infrastructure was seized without operator arrests, reconstitution under new branding is probable within 3-6 months, consistent with historical cybercriminal marketplace resilience. The commercialized nature of the ecosystem suggests that demand for phishing-as-a-service infrastructure will persist, potentially driving remaining or new Chinese-language operators to fill the market gap. Organizations in Japan, the United States, Australia, and India should anticipate continued targeting, potentially with evolved tactics as threat actors adapt to the disruption. If law enforcement agencies pursue follow-on actions against downstream customers who purchased from YAM Store, secondary disruptions of phishing campaigns may occur in Q2-Q3 2025. Cloud providers, particularly Microsoft and Google, will likely face pressure to enhance tenant verification processes to prevent fraudulent environment acquisition. The incident may accelerate regulatory discussions in the Asia-Pacific region regarding cryptocurrency transaction monitoring and cloud service provider due diligence requirements.