Microsoft, Japanese Police Disrupt Cybercrime 'App Store' Network
Microsoft and Japanese police disrupted cybercrime services tied to over a billion malicious messages.
The operation targeted three linked services—the YAM Store, CoGUI and Iron Man—which investigators say were used to target 75,000 organizations in more than 150 countries. According to Microsoft, the services sent more than one billion malicious communications promoting scams and generated millions of dollars for their operators. About 750 million of those messages were aimed at Microsoft’s own customers. Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs took part alongside Microsoft and Japanese authorities.
Investigators described the marketplace as an entry point into cybercrime for users who did not need to write their own code. It offered pre-fabricated fake websites and messages designed to convince targets they were dealing with genuine organizations. The fakes included Amazon, government agencies, financial institutions and other well-known companies, Microsoft said; scammers could host convincing pages to steal login and payment credentials.
CoGUI, a phishing-as-a-service framework, initially evaded security filtering through methods that included browser fingerprinting and geofencing, according to the report. It appeared to target victims in Japan and the United States and was later replaced by a new service, Iron Man.
The YAM Store operated in a wholly Chinese-language environment, which required native speakers to be added to the investigating team so they could gain access to the underground marketplace. Microsoft assigned it the tracking number Storm-3119 and called it an “Initial Access Broker” that provided customers with “compromised or fraudulently obtained environments in providers like Microsoft and Google.”
To keep its inventory current, the YAM Store used automation to identify expired environment or organization names and then drew on legitimate customer information associated with them to help evade existing detections, Microsoft said.
Microsoft said it had seized domains associated with the YAM, CoGUI and Iron Man infrastructure and had either blocked or redirected them. The company said it was working with law enforcement agencies worldwide to take down illegal operations that target businesses and individuals.