Today, Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience, moved to dismantle domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure. Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone.
Microsoft has a blog on it here: https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations
Sina Chehreghani, Head of Threat Intel and Threat Research at Securonix, provided the following comments:
“The takedown disrupted three services that helped criminals acquire accounts, phishing kits and infrastructure at scale. Microsoft says they were used to send more than one billion malicious messages since January, targeting people and more than 75,000 organizations across 150 countries. That volume reflects a service economy built to lower the effort required to launch and repeat campaigns. Health-ISAC’s involvement also points to the pressure on hospitals and healthcare organizations, where compromised accounts can expose sensitive information and disrupt essential operations.
“A takedown gives defenders useful intelligence, but it does not confirm that every exposed account or related campaign has been contained. Security teams should use the indicators shared by Microsoft and Health-ISAC to review sign-in activity, inbox rules, forwarding changes, consent grants and suspicious access to cloud applications. They should also look for attempts to reuse compromised accounts or shift to replacement domains and infrastructure. Threat intelligence is most useful when it reaches detection and investigation workflows quickly, giving analysts context to connect current alerts with activity tied to the disrupted services.”
Take downs like this work. But there isn’t enough of them, and they aren’t done at scale. Thus they need to more of them and done on a massive scale to have a dent on the cybercrime industry.
Related
This entry was posted on October 14, 2026 at 6:12 pm and is filed under Commentary with tags Microsoft. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Microsoft Disrupts 3 Major Phishing Platforms Used by Chinese Hackers
Today, Microsoft and Health-ISAC, a global non-profit that helps health sector organizations share cyber threat information and collaborate to improve operational resilience, moved to dismantle domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure. Since January 2026, YAM Store, CoGUI and Iron Man have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide, including more than 750 million messages geared toward Microsoft customers alone.
Microsoft has a blog on it here: https://blogs.microsoft.com/on-the-issues/2026/10/14/disrupting-the-service-economy-behind-transnational-cybercrime-operations
Sina Chehreghani, Head of Threat Intel and Threat Research at Securonix, provided the following comments:
“The takedown disrupted three services that helped criminals acquire accounts, phishing kits and infrastructure at scale. Microsoft says they were used to send more than one billion malicious messages since January, targeting people and more than 75,000 organizations across 150 countries. That volume reflects a service economy built to lower the effort required to launch and repeat campaigns. Health-ISAC’s involvement also points to the pressure on hospitals and healthcare organizations, where compromised accounts can expose sensitive information and disrupt essential operations.
“A takedown gives defenders useful intelligence, but it does not confirm that every exposed account or related campaign has been contained. Security teams should use the indicators shared by Microsoft and Health-ISAC to review sign-in activity, inbox rules, forwarding changes, consent grants and suspicious access to cloud applications. They should also look for attempts to reuse compromised accounts or shift to replacement domains and infrastructure. Threat intelligence is most useful when it reaches detection and investigation workflows quickly, giving analysts context to connect current alerts with activity tied to the disrupted services.”
Take downs like this work. But there isn’t enough of them, and they aren’t done at scale. Thus they need to more of them and done on a massive scale to have a dent on the cybercrime industry.
Share this:
Like this:
Related
This entry was posted on October 14, 2026 at 6:12 pm and is filed under Commentary with tags Microsoft. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.