Storm-2990 (Threat actor): news timeline & CVEs

Iron Man Phishing-as-a-Service Kit Impersonates Banks, Couriers and Government Agencies Worldwide

Iron Man phishing-as-a-service impersonates banks and agencies; Microsoft tracks its developers as Storm-2990.

Resecurity and Microsoft describe Iron Man System, a commercial phishing-as-a-service kit that supplies self-hosted sites impersonating banks, couriers, tax agencies, and other organizations. A lab deployment of version 6.3.1 used a Go backend, and Resecurity counted 2,360 templates across 130 countries, with licensing tied to api2.peaceman.cc. Operators collect credentials, payment data, and verification codes over WebSockets and can steer sessions interactively, with Telegram notifications, geofencing, fake CAPTCHA gates, and IP filtering. Microsoft tracks the developers of Iron Man, CoGUI, and Haozi as Storm-2990 and links the wider YAM Store ecosystem, tracked as Storm-3119, to more than one billion malicious messages since January 2026, a figure not exclusive to Iron Man. Microsoft and Health-ISAC obtained a Florida federal order to seize supporting domains.

GBHackersupdated Oct 16, 11:26 UTC · 17h agofirst Oct 15, 10:32 UTC · 1d agoPhishing & fraud in the wild 13 sources1

Microsoft disrupts phishing network behind more than a billion scam messages

Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.

Microsoft and Resecurity identified YAM Store, tracked as Storm-3119, which sold the CoGUI, Haozi, and Iron Man System phishing kits attributed collectively to Storm-2990. Since January 2026 those kits helped send more than one billion phishing emails and SMS messages targeting over 75,000 organizations in healthcare, financial services, wholesale, and IT across Japan, the United States, Australia, and India. The market also sold compromised or fraudulently obtained Microsoft and Google cloud accounts, reset passwords, assigned licenses, and turned SharePoint and OneDrive into buyer hosting; Iron Man System contained more than 2,335 templates for over 139 countries and alerted operators on Telegram. With Health-ISAC and an order from the US District Court for the Southern District of Florida, Microsoft seized supporting domains, disabled more than 20,000 accounts, and blocked more than 100,000 impersonation domains after a late-2025 referral from Japan's National Police Agency.

Help Net Securityupdated Oct 16, 11:26 UTC · 17h agofirst Oct 15, 10:10 UTC · 1d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages

Microsoft and partners disrupted Yam Store, a phishing service behind over one billion messages since January 2026.

Microsoft and partners, including Japanese police, disrupted Yam Store (Storm-3119), a Chinese-language phishing-as-a-service marketplace. Its CoGUI, Haozi, and Iron Man System kits, tracked as Storm-2990, sent more than one billion phishing emails and texts to over 75,000 organizations since January 2026, hitting healthcare, finance, wholesale, and IT in Japan, the US, Australia, and India. Operators reused expired domains and fake tenants to obtain Microsoft 365 and Google accounts for resale, using fake login pages, device-code phishing, and payment theft. Microsoft disabled more than 20,000 accounts and blocked over 100,000 domains.

Infosecurity Magazineupdated Oct 16, 11:26 UTC · 17h agofirst Oct 15, 10:00 UTC · 1d agoPhishing & fraud in the wild 13 sources2

Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages

Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.

Microsoft, Health-ISAC, Japan’s JC3, and private partners announced a court-authorized disruption of phishing kits CoGUI (NX/FA), Haozi (Phoenix), and Iron Man System. Since January 2026, operators facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations in more than 150 countries, generating tens of millions of dollars. Microsoft tracks marketplace YAM Store as Storm-3119 and the kit developers as Storm-2990; the kits were sold for cryptocurrency and used compromised or fraudulent Microsoft and Google cloud tenants, including SharePoint and OneDrive hosting. About 17,000 domains and more than 2,300 brand-impersonation templates were involved, with real-world CoGUI use since at least October 2024.

The Hacker Newsupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 17:09 UTC · 2d agoPhishing & fraud in the wild 13 sources

Global takedown hits network behind 1 billion phishing messages

Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.

Microsoft, Japan’s National Police Agency, and partners disrupted YAM Store (Storm-3119) and phishing kits CoGUI, Haozi, and Iron Man, tracked as Storm-2990. The ecosystem is linked to more than a billion malicious email and SMS messages aimed at over 75,000 organizations in 150 countries, including over 750 million messages to Microsoft customers, many using device-code phishing. Operators bought expired domains, built fake organizations with AI, and abused SharePoint and OneDrive. Under a Southern District of Florida order, Microsoft seized related domains, deactivated over 20,000 accounts, and blocked 100,000 impersonation domains.

BleepingComputerupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:12 UTC · 2d agoPhishing & fraud in the wild 13 sources

The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

Microsoft details a Chinese-language phishing-kit market that enabled over one billion messages to 75,000 organizations.

Microsoft’s Digital Crimes Unit described a Chinese-language phishing ecosystem centered on YAM Store, tracked as Storm-3119, which brokers compromised or fraudulently obtained Microsoft and Google cloud environments. Kits sold there—CoGUI, Haozi, and Iron Man, tracked collectively as Storm-2990—facilitated more than one billion phishing emails and SMS messages to over 75,000 organizations since January 2026. Targets included healthcare, financial services, wholesale distribution, and IT organizations in Japan, the United States, Australia, and India. Storm-3119 used Tor-anonymized reconnaissance to profile Microsoft 365 tenants, then hijacked education tenants and resold accounts, licenses, and storage; Microsoft and partners disrupted the primary infrastructure.

Microsoft Security Blogupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:00 UTC · 2d agoThreat actor in the wild 13 sources

Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem

Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.

Microsoft, Japanese authorities, Health-ISAC, and several security companies disrupted Chinese-language phishing kits tracked as Storm-2990. Since the start of 2026, the kits sent more than one billion phishing emails and SMS messages to more than 75,000 organizations, with more than three-quarters aimed at Microsoft customers. Under a federal court order, Microsoft and Health-ISAC seized and redirected domains powering YAM Store, CoGUI, and Iron Man; Microsoft also disabled more than 20,000 accounts and is blocking more than 100,000 impersonation domains. Criminals used the kits to steal credentials and financial data and abused device-code authentication to obtain tokens, mainly for payment fraud against healthcare, finance, logistics, and IT targets in the United States and Japan.

CyberScoopupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:00 UTC · 2d agoPhishing & fraud in the wild 13 sources

Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages

Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.

Microsoft and Health-ISAC, under an order from the US District Court for the Southern District of Florida, seized and redirected domains used by YAM Store, CoGUI, and Iron Man. Microsoft says those services sent more than one billion malicious messages since January 2026 to consumers and over 75,000 organizations in more than 150 countries, including over 750 million aimed at Microsoft customers. YAM Store, tracked as Storm-3119, resold compromised Microsoft 365 and Azure for Education tenants, while CoGUI, Haozi, and Iron Man are Storm-2990 phishing kits that harvest credentials and one-time codes. Microsoft disabled over 20,000 related accounts and is blocking more than 100,000 impersonation domains.

SecurityWeekupdated Oct 16, 11:26 UTC · 17h agofirst Oct 14, 13:00 UTC · 2d agoPhishing & fraud in the wild 13 sources

Storm-2990

Timeline8 articles

Appears with