Microsoft's Digital Crimes Unit and Health-ISAC said Wednesday they had seized and redirected domains behind three parts of a Chinese-language cybercrime marketplace: YAM Store, CoGUI and Iron Man. They acted on an order from the U.S. District Court for the Southern District of Florida. Microsoft's count is that since January 2026 the three have enabled more than one billion malicious messages aimed at over 75,000 organizations in more than 150 countries, and more than 750 million of those went after Microsoft customers. Targets were consumers, healthcare organizations, financial institutions and other businesses, and the operators made tens of millions of dollars (per Microsoft). Microsoft says it has disabled more than 20,000 accounts connected to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
The three pieces. Microsoft Threat Intelligence tracks YAM Store as Storm-3119. It describes it as an initial access broker that hijacks Microsoft 365 and Azure for Education tenants, then resells the accounts, licenses and storage. It also rebuilt organizations that had let their domains lapse, nonprofits and schools especially, so it could get Microsoft 365 tenants that looked legitimate, and in at least one case it made up a nonprofit from nothing. Buyers paid in Alipay, WeChat Pay or USDT. Microsoft tracks the developers of the CoGUI, Haozi and Iron Man System kits as Storm-2990. CoGUI hit Japan and the U.S. hardest, and by mid-2026 it was giving way to Iron Man, which YAM Store started advertising in June. By Microsoft's count Iron Man ships more than 2,335 templates across 139+ countries. Resecurity bought a license and counted 2,360 (per SecurityWeek). The U.S. has the most templates, and most U.S. lures pose as transportation or government bodies: tolls, parking, traffic fines.
The tradecraft worth knowing. The tenant side is the part enterprise identity teams should read twice. Microsoft says Storm-3119 profiled Microsoft 365 tenants over Tor and used a stolen client secret with app-only authentication to reset passwords silently (no forced change at next sign-in) and assign licenses. From a Global Administrator account it self-provisioned the PnP Management Shell service principal and granted itself broad Microsoft Graph permissions, including AppCatalog.ReadWrite.All and full SharePoint control. Then it used the victim's SharePoint and OneDrive as bulk hosting. Because the access lives at the app level, not in one user's session, resetting a single password doesn't end it. The kits themselves use geofencing, fake CAPTCHA gates and IP allow and block lists, plus Telegram bots that ping the operator as soon as a victim types something. Credentials go out over a WebSocket, so the operator can watch each victim live and ask for the one-time code on the spot. Some downstream crews also used device code phishing (per Microsoft).
Who saw what. It started in late 2025 when Japan's National Police Agency flagged scam campaigns aimed at people in Japan. JC3, Resecurity, Cloudflare, Oracle, Proofpoint and TRM Labs joined later, and Microsoft shared intelligence with the U.S. Secret Service and international law enforcement. Proofpoint says the CoGUI family is the highest-volume direct email threat in its data. It blocks more than 100 million CoGUI messages a month and has counted about 17,000 unique domains across CoGUI and two related kits it calls CoAceV and CoFish_Ws, including 3,788 FQDNs between Jul 1 and Sep 17 alone. Health-ISAC joined the civil suit because hospitals and healthcare organizations kept getting hit (per SecurityWeek).
Our read. Seizing domains from a crew that burns through thousands of FQDNs a quarter won't end this by itself. The useful detail is from Resecurity: the Iron Man panel can't run without regular check-ins to the vendor's licensing server, so taking that host down hurts every customer deployment at once, not only the one under investigation (per SecurityWeek). Expect a dip in toll and parcel smishing, then a rebrand. For buyers, the uncomfortable part is that the inventory was real tenants, some of them schools and nonprofits that let a domain lapse.
What we'd do this morning. In Entra, list your service principals and look for PnP Management Shell or any other app nobody in IT remembers consenting to. Pull every app holding AppCatalog.ReadWrite.All or tenant-wide SharePoint rights and rotate client secrets you can't tie to an owner. Search the audit logs for password resets done by an application rather than an admin. If you don't need device code flow, block it with Conditional Access, and put privileged roles on passkeys or other phishing-resistant MFA, because a live operator relays SMS codes as fast as your users type them. On the brand side, watch newly registered lookalikes of your name and your login portal, and keep paying for domains you've retired, since an expired .org is exactly what Storm-3119 shopped for. Defender XDR customers should open Microsoft's "Evolving phishing threats" Threat Analytics report. Health-ISAC members should pull the indicators shared through Health-ISAC. Proofpoint's post also lists URL-path patterns you can grep for in proxy logs.