YAM Store: How to Detect & Block 1B-Message Phishing Networks

Executive Summary

In a landmark multinational cybercrime disruption, the Microsoft Digital Crimes Unit (DCU), the Health Information Sharing and Analysis Center (Health-ISAC), the Japan Cybercrime Control Center (JC3), and private sector partners—including Proofpoint, Cloudflare, and Resecurity—have dismantled the core infrastructure powering YAM Store (tracked by Microsoft as Storm-3119) and its associated phishing-as-a-service (PaaS) developer ecosystem (tracked as Storm-2990).

Operating as a premier underground infrastructure broker in Chinese-language cybercrime forums, YAM Store supplied commodity cybercriminals and initial access brokers (IABs) with industrialized phishing infrastructure. Intelligence telemetry reveals the network facilitated the transmission of over one billion phishing emails and SMS messages, targeting more than 75,000 organizations across 150 countries. The syndicate specialized in weaponizing expired or aged corporate domains with established reputation, abusing legitimate Microsoft 365 and Google Workspace cloud tenants, and deploying sophisticated Adversary-in-the-Middle (AiTM) phishing kits—most notably CoGUI and the Iron Man System.

Backed by a civil seizure order issued by the U.S. District Court for the Southern District of Florida, authorities seized the central domain infrastructure orchestrating YAM Store and its kit licensing servers, while Microsoft terminated more than 20,000 fraudulent cloud accounts and blocked upwards of 100,000 malicious domains.

This threat intelligence dispatch delivers a technical architecture breakdown of the YAM Store ecosystem, its cloud tenant exploitation mechanics, MITRE ATT&CK mappings, validated detection queries (Sigma, Microsoft Sentinel KQL, and Splunk SPL), and enterprise defensive playbooks.

---

Technical Vulnerability Analysis & Attack Chain

The YAM Store operational pipeline functioned as an end-to-end industrial cybercrime supply chain spanning five coordinated stages:

1. Domain & Cloud Infrastructure Ingestion: Storm-3119 systematically scanned domain registrar drops to purchase expired, aged domains previously belonging to defunct businesses, healthcare organizations, and educational institutions. Concurrently, the actors created fraudulent Microsoft 365 and Google Workspace enterprise tenants using stolen payment credentials or free trial exploits.
2. AI Lure & Phishing Kit Staging: Threat cluster Storm-2990 supplied commercial phishing platforms. The Iron Man System provided over 2,300 pre-configured lure templates mimicking major financial institutions, postal couriers (DHL, USPS, Japan Post), tax authorities, and telecoms. Attackers leveraged generative AI models to craft flawless multilingual phishing copy and generate synthetic corporate documentation.
3. 1B+ Multi-Channel Mass Transmission: Attackers blasted high-velocity phishing campaigns over email and SMS (smishing). By relaying outbound traffic through compromised or fraudulent enterprise cloud tenants, the messages inherited high sender reputation scores, circumventing standard DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF), and Secure Email Gateway (SEG) domain-age heuristics.
4. Adversary-in-the-Middle (AiTM) Token Theft: Lure links directed victims through multi-stage anti-analysis gates (geofencing, fake CAPTCHAs, bot-filtering proxies) to reverse-proxy authentication landing pages. When victims entered credentials and completed multi-factor authentication (MFA) challenges, the proxy captured the authenticated session cookie (ESTSAUTH, ESTSAUTHPERSISTENT) in real time, bypassing traditional SMS, push, or OTP protections.
5. Global Disruption & Infrastructure Seizure: A joint legal and technical takedown enabled Microsoft and Health-ISAC to seize the primary command-and-control, licensing, and redirection domains. Concurrently, Microsoft terminated tens of thousands of rogue cloud tenants, severing the syndicate's distribution channels.

Root-Cause & Exploitation Mechanics

1. Expired Domain Weaponization & Reputation Hijacking

Modern Secure Email Gateways (SEGs) heavily penalize newly registered domains (NRDs), typically quarantining traffic from domains registered within the preceding 30 to 90 days. Storm-3119 bypassed this defense through aged domain acquisition:

• Actors acquired domains that had lapsed after years of legitimate commercial activity.
• These domains maintained established WHOIS histories, clean categorization in threat intelligence feeds, and pre-existing historical trust scores across major filtering vendors.
• When reactivated with custom DNS records (MX, SPF, DMARC), the domains delivered mass phishing with near-zero initial filtering resistance.

2. Fraudulent Cloud Tenant Relay Abuse

Rather than relying solely on easily blocklisted VPS servers or bulletproof hosting providers, YAM Store operators abused legitimate cloud hyper-scalers:

• Automated scripts provisioned fraudulent Microsoft 365 and Google Workspace accounts.
• The actors configured inbound and outbound mail connectors to route millions of phishing emails through legitimate Microsoft Exchange Online Protection (EOP) and Google mail servers.
• Because the sending IP addresses resolved directly to legitimate cloud infrastructure (*.outbound.protection.outlook.com), reputation-based network filtering engines permitted delivery into corporate inboxes.

3. Modular PaaS Kits: CoGUI and Iron Man System

Storm-2990 operated a sophisticated software-as-a-service model, vending modular kits:

• CoGUI (NX / FA): Heavily optimized for targeting banking and enterprise users in Japan and North America. It integrates advanced client-side JavaScript fingerprinting that evaluates browser canvas data, WebGL renderers, and mouse movement to detect automated EDR sandboxes and headless scrapers.
• Iron Man System: A massive repository containing 2,300+ localization templates. It features dynamic content rendering that detects the victim's IP geolocation and mobile operating system (iOS vs. Android), dynamically tailoring the brand lure (e.g. domestic postal service notifications for mobile users, enterprise Single Sign-On portals for desktop users).
• Reverse-Proxy AiTM Capture: Both kits implement dynamic reverse-proxy modules that relay HTTP requests between the victim and authentic identity provider endpoints (login.microsoftonline.com, accounts.google.com). When authentication succeeds, the proxy intercepts the resulting HTTP Set-Cookie response headers, exfiltrating full session tokens to the attacker's administrative dashboard.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Threat Actor Profile & Campaign Attribution

The YAM Store disruption targets a mature, multi-layered cybercriminal cartel operating primarily across Chinese-language cybercrime networks:

• Storm-3119 (YAM Store): Acts as the marketplace broker and logistics provider. The group specialized in bulk infrastructure acquisition, bulletproof payment processing, and monetization of stolen enterprise credentials.
• Storm-2990: The developer syndicate engineering the underlying malware kits (CoGUI / NX / FA, Iron Man System, Haozi / Phoenix). They operate ongoing subscription licensing models, continuous evasion updates, and centralized C2 telemetry collection.
• Global Victim Landscape: Telemetry documented active targeting across healthcare, financial services, government agencies, telecommunications, and manufacturing sectors in more than 150 countries, with acute concentration in the United States, Japan, and Western Europe.
• Coordinated Disruption Coalition: Executed through joint civil litigation in the U.S. District Court for the Southern District of Florida alongside technical telemetry contributions from Microsoft DCU, Health-ISAC, JC3, Proofpoint, Cloudflare, and Resecurity.

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

Step 1: Enforce Phishing-Resistant MFA (FIDO2 / Certificate-Based Auth)

Traditional push notifications, TOTP codes, and SMS OTPs are inherently vulnerable to reverse-proxy AiTM token theft. Transition all administrative and standard user accounts to FIDO2 WebAuthn or Windows Hello for Business:

# PowerShell / Microsoft Graph: Audit Authentication Methods for Phishing Resistance
Import-Module Microsoft.Graph.Identity.SignIns

# Retrieve users without FIDO2 security keys registered
$Users = Get-MgUser -All
$NonFidoUsers = foreach ($User in $Users) {
    $Methods = Get-MgUserAuthenticationFido2Method -UserId $User.Id -ErrorAction SilentlyContinue
    if (-not $Methods) {
        [PSCustomObject]@{
            UserPrincipalName = $User.UserPrincipalName
            Fido2Enrolled     = $false
        }
    }
}

Write-Warning "Detected $($NonFidoUsers.Count) users lacking phishing-resistant FIDO2 enrollment."

Step 2: Configure Exchange Online Protection (EOP) Expired Domain Heuristics

Deploy mail flow rules to flag or quarantine incoming emails from external domains that exhibit sudden high-volume delivery following extended dormancy:

# Exchange Online PowerShell: Create Transport Rule to Flag Newly Observed / Suspicious Senders
New-TransportRule -Name "Quarantine Suspicious High-Volume Inbound Phishing Relays" `
    -FromScope NotInOrganization `
    -HeaderContainsMessageHeader "Authentication-Results" `
    -HeaderContainsWords "dmarc=fail", "spf=softfail" `
    -SetAuditSeverity High `
    -ApplyHtmlDisclaimerLocation Append `
    -ApplyHtmlDisclaimerText "<div style='background-color:#ffebe8; border:2px solid #c00; padding:10px;'><b>WARNING:</b> This email originated from an external sender with unverified domain credentials. Do not click links or input credentials.</div>"
Write-Output "Mail flow transport disclaimer successfully deployed."

Step 3: Revoke Stolen Session Tokens and Enforce Continuous Access Evaluation (CAE)

When AiTM token compromise is suspected, immediately terminate all active refresh tokens and enable Continuous Access Evaluation:

# Immediately revoke all active user sessions and refresh tokens for compromised identity
$CompromisedUPN = "target.user@enterprise.com"
Revoke-MgUserSignInSession -UserId $CompromisedUPN
Write-Output "All active OAuth session cookies and refresh tokens revoked for $CompromisedUPN."

---

2. Network & Perimeter Defenses

1. Enforce Conditional Access Device Compliance: Require that all access to cloud applications originates from Intune-managed, compliant devices. Even if an AiTM proxy intercepts a session cookie, access is denied unless the client presents a valid device certificate.
2. Block Known Cloud Storage Redirection Paths: Restrict outbound user access to unvetted dynamic hosting and worker subdomains (*.workers.dev, *.vercel.app, *.pages.dev) commonly weaponized by CoGUI and Iron Man as intermediate redirection trampolines.
3. Deploy Strict Inbound DMARC Policies: Configure your organization's domain to p=reject with 100% enforcement, ensuring spoofed emails impersonating internal leadership are rejected at the gateway.

---

3. Endpoint Detection & Hunting Query

Sigma Rule: Suspicious Cloud Authentication Originating from Known AiTM Proxy Indicators

title: Potential AiTM Session Token Replay Authentication
id: 7c2a1e4d-3b8f-4a01-92e1-85b19c43ef12
status: experimental
description: Detects user authentications utilizing session cookies where the client IP address changes dramatically within a short time window without MFA re-prompt, indicative of AiTM token theft.
references:
    - https://www.darkreading.com/cyberattacks-data-breaches/yam-store-phishing-network-behind-billion-messages
author: CyberNewsAI Threat Research Team
date: 2026-10-14
logsource:
    service: signinlogs
    product: azure
detection:
    selection_signin:
        ResultType: 0 # Successful sign-in
    selection_risk:
        RiskLevelDuringSignIn:
            - 'high'
            - 'medium'
        RiskEventType:
            - 'anomalousToken'
            - 'unfamiliarFeatures'
            - 'tokenIssuerAnomaly'
    condition: selection_signin and selection_risk
falsepositives:
    - Legitimate corporate VPN switching
level: high
tags:
    - attack.credential_access
    - attack.t1539
    - attack.initial_access
    - attack.t1566

Microsoft Sentinel / Defender KQL Hunting Query

// Hunt for Stolen Token Replay & Anomalous Tenant Access Associated with Storm-3119 / Storm-2990
let lookback = 7d;
SigninLogs
| where TimeGenerated >= ago(lookback)
| where ResultType == 0
| where RiskState == "atRisk" or RiskLevelDuringSignIn in ("high", "medium")
| extend City = tostring(LocationDetails.city), Country = tostring(LocationDetails.countryOrRegion)
| summarize SigninCount = count(), 
    DistinctIPs = dcount(IPAddress), 
    DistinctUserAgents = dcount(UserAgent), 
    IPList = make_set(IPAddress), 
    Earliest = min(TimeGenerated), 
    Latest = max(TimeGenerated) 
    by UserPrincipalName, AppDisplayName
| where DistinctIPs > 1 and DistinctUserAgents > 1
| project Earliest, Latest, UserPrincipalName, AppDisplayName, DistinctIPs, DistinctUserAgents, IPList
| order by Latest desc

Splunk SPL Hunting Query

index=o365 sourcetype="o365:management:activity" Operation="UserLoggedIn" ResultStatus="Succeeded"
| eval ClientIP=ActorIpAddress, User=UserId
| stats count earliest(_time) as first_seen latest(_time) as last_seen dc(ClientIP) as ip_count dc(UserAgent) as ua_count values(ClientIP) as ips by User
| where ip_count > 1 and ua_count > 1
| table first_seen, last_seen, User, ip_count, ua_count, ips
| sort - ip_count

---

Threat Actor Infrastructure & Ecosystem Attribution

Legal & Disruption Dockets

Note: Specific individual domain names (over 100,000 blocked) and infrastructure IP addresses were sinkholed via federal court order and dynamically ingested into Microsoft Defender XDR and commercial threat intelligence feeds; hunt using behavioral indicators, token replay anomalies, and mail flow rules described above.