Executive Summary
In early 2025, Microsoft collaborated with Japanese authorities and cybersecurity partners to dismantle a massive Chinese-language phishing kit ecosystem tracked as Storm-2990. The operation involved interconnected services including YAM Store, CoGUI, and Iron Man that delivered over 1 billion phishing emails and SMS messages to more than 75,000 organizations globally. The cybercriminal network primarily targeted healthcare, financial services, logistics, and IT sectors in the United States and Japan, selling customized phishing kits that enabled credential theft, financial fraud, and device code authentication abuse.
This incident highlights the growing sophistication of transnational cybercriminal operations and the increasing threat of supply-chain style cybercrime services. The emergence of organized phishing-as-a-service ecosystems represents a significant shift in threat landscape maturity, where criminal groups operate like legitimate businesses with specialized roles and infrastructure.
Why This Matters Now
The disruption of Storm-2990 exposes the industrialized nature of modern phishing operations, where criminal groups operate sophisticated supply chains selling turnkey attack tools. This represents an urgent escalation in cybercrime organization and scale.
Attack Path Analysis
Storm-2990 distributed Chinese-language phishing kits through YAM Store, CoGUI, and Iron Man platforms to deliver over 1 billion phishing messages targeting Microsoft customers globally. Victims clicking malicious links provided credentials that were harvested and used to obtain authentication tokens for account access. Threat actors leveraged compromised accounts to move laterally within organizations and establish persistent command channels. Stolen financial data and credentials were exfiltrated to external infrastructure for monetization through fraudulent purchases and financial fraud operations.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Storm-2990 distributed phishing kits containing 2,360 templates impersonating legitimate brands across 130 countries, delivering over 1 billion phishing emails and SMS messages to harvest credentials through device code authentication abuse
MITRE ATT&CK® Techniques
Phishing
Phishing: Spearphishing Attachment
Phishing: Spearphishing Link
Multi-Factor Authentication Request Generation
Valid Accounts
Modify Authentication Process: Hybrid Identity
Acquire Infrastructure: Domains
Establish Accounts: Email Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Incident Response Plan Implementation
Control ID: 12.10.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
DORA – ICT Third-Party Risk Management
Control ID: Article 11
CISA ZTMM 2.0 – Identity Verification and Authentication
Control ID: Identity Pillar
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
HIPAA – Assigned Security Responsibilities
Control ID: 164.308(a)(6)(ii)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Healthcare organizations face credential theft and financial fraud through sophisticated Chinese phishing kits targeting authentication tokens, requiring enhanced egress security.
Financial Services
Financial institutions experience direct targeting via phishing templates impersonating banks, enabling fraudulent transactions and payment data theft across platforms.
Logistics/Procurement
Logistics companies encounter package delivery phishing scams and supply chain disruption through compromised credentials affecting operational continuity and trust.
Information Technology/IT
IT organizations face infrastructure compromise through device code authentication abuse and lateral movement, requiring zero trust segmentation and anomaly detection.
Sources
- Microsoft and partners disrupt vast Chinese-language phishing kit ecosystemhttps://cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/Verified
- Microsoft Digital Crimes Unit disrupts Storm-2990 phishing operationhttps://blogs.microsoft.com/on-the-issues/2025/01/22/storm-2990-phishing-operation-disruption/Verified
- CISA Alert on Phishing and Social Engineering Attackshttps://www.cisa.gov/news-events/alerts/aa21-336aVerified
- Resecurity Analysis of Iron Man Phishing Infrastructurehttps://resecurity.com/blog/article/iron-man-phishing-infrastructure-analysisVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have constrained Storm-2990's lateral movement and data exfiltration by implementing identity-aware segmentation and controlled egress paths. The segmented architecture would likely have reduced the attackers' blast radius across compromised cloud environments and limited their ability to pivot between resources.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While initial credential compromise would likely still occur, CNSF's identity-aware access controls would constrain the immediate reach and scope of compromised account usage across cloud resources
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation would likely constrain privilege escalation attempts by limiting token-based access to predefined resource boundaries and enforcing granular access controls between cloud services
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely restrict lateral movement by blocking unauthorized service-to-service communications and limiting cross-resource access paths within the cloud environment
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility would likely detect and constrain persistent access patterns by monitoring cross-cloud communications and identifying anomalous authentication behaviors across distributed infrastructure
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely constrain data exfiltration by blocking unauthorized outbound transfers and limiting access to external destinations from compromised cloud resources
While financial fraud would likely still occur with already-extracted data, the reduced scope of compromised information would limit the scale and duration of fraudulent activities
Impact at a Glance
Affected Business Functions
- Customer Authentication Systems
- Financial Transaction Processing
- Healthcare Patient Data Management
- Corporate Email and Communications
Estimated downtime: N/A
Estimated loss: N/A
Credentials, financial data, and authentication tokens for over 75,000 organizations globally across healthcare, financial services, logistics and IT sectors. Approximately 2,360 phishing templates impersonated banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries. Personal and corporate account access compromised through device code authentication abuse.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation and identity-based policies to prevent lateral movement from initially compromised accounts across cloud services and workloads
- • Deploy egress security controls and FQDN filtering to block unauthorized outbound connections to the 100,000+ malicious domains used by Storm-2990
- • Enable multicloud visibility and anomaly detection to identify suspicious authentication patterns and device code authentication abuse across hybrid environments
- • Establish encrypted traffic inspection capabilities to detect credential harvesting and data exfiltration attempts in real-time
- • Deploy inline IPS with updated threat signatures to block known phishing kit payloads and prevent initial compromise through malicious email campaigns
