Microsoft and Health-ISAC seize domains tied to crypto-paid phishing suppliers
in plain words
Microsoft and a security group took control of web addresses used by criminal shops that sold stolen logins and scam tools. The shops took payment in cryptocurrency. The companies got a court order to stop the sites from being used.
Full summary
Microsoft and the cybersecurity group Health-ISAC obtained a US court order to seize and redirect domains that supported YAM Store, CoGUI and Iron Man. The three services sold accounts and phishing Impersonating a trusted party to steal data, often with look-alike domains. Full definition of phishing tools to fraudsters. In an October 14 statement, Microsoft said it had disabled more than 20,000 accounts linked to YAM Store and was continuing to block more than 100,000 impersonation and fraud domains.
Microsoft said the services had helped criminals send messages targeting more than 75,000 organizations in more than 150 countries since January, and that they generated tens of millions of dollars for their operators. The company linked the network to more than one billion phishing messages worldwide this year.
The investigation began after Japan's National Police Agency alerted Microsoft to scams aimed at consumers and businesses late last year. Investigators traced the campaigns to a Chinese-language market where criminal groups could buy the infrastructure to run phishing operations.
YAM Store supplied fraudulently obtained Microsoft and Google accounts, cloud resources and hosting. Some operators revived expired domains belonging to nonprofits and educational organizations, then used the apparently legitimate sites to obtain Microsoft 365 accounts for resale. CoGUI and Iron Man supplied ready-made phishing pages and messages that imitated banks, retailers, transport authorities and government agencies. Microsoft and the security firm Resecurity identified more than 2,300 Iron Man templates.
Microsoft's technical investigation found that the services accepted cryptocurrency, including Tether's USDT and Ethereum. YAM Store's storefront supported USDT on the Tron network alongside Alipay and WeChat Pay. Cloudflare said buyers could also pay for marketplace offerings with USDC. YAM Store also ran a sub-reseller tier.
Blockchain analytics firm TRM Labs said its intelligence helped investigators locate assets linked to the group and freeze them. The company did not state the value of the frozen assets.
Cloudflare said it suspended accounts, disabled Workers projects supporting phishing pages and banned hundreds of associated domains and projects. Where it could not seize domains, it placed warning pages in front of malicious links.
The crackdown involved Japan's police and Cybercrime Control Center, along with Oracle, Proofpoint, Resecurity and US law-enforcement partners. Microsoft said the suppliers were part of a larger criminal network, and related infrastructure is still being removed. Cloudflare said some domain registrar A company that registers domain names for customers with the registry. Full definition of registrar operate in jurisdictions that make legal seizures difficult.