{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/iab/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Storm-2990"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Microsoft Cloud","Google Cloud"],"_cs_severities":["high"],"_cs_tags":["phishing","iab","credential-harvesting","cloud-security","storm-2990"],"_cs_type":"threat","_cs_vendors":["Microsoft","Google"],"content_html":"\u003cp\u003eMicrosoft identified and disrupted a complex, interconnected cybercriminal ecosystem operating since at least January 2026. The network consists of two primary clusters: Storm-3119, an Initial Access Broker (IAB) operating the 'YAM Store' marketplace, and Storm-2990, a group of developers behind the 'CoGUI', 'Haozi', and 'Iron Man System' phishing kits. Storm-3119 leverages automation to identify and acquire fraudulent or expired cloud environments (Microsoft and Google), which are then sold via Telegram-based channels to downstream threat actors. Storm-2990 creates and markets phishing kits designed to mimic legitimate government, financial, and logistics organizations. This infrastructure has facilitated over one billion phishing attempts against more than 75,000 organizations in Japan, the United States, Australia, and India. The convergence of these entities allows even low-skill actors to launch high-volume credential theft operations by renting pre-configured, reputable cloud infrastructure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eStorm-3119 identifies expired or vulnerable customer organization environments within major cloud platforms.\u003c/li\u003e\n\u003cli\u003eStorm-3119 exploits legitimate customer information and automation to provision or take over these cloud workspaces.\u003c/li\u003e\n\u003cli\u003eStorm-3119 lists access to these fraudulently acquired environments on the YAM Store marketplace.\u003c/li\u003e\n\u003cli\u003eDownstream threat actors purchase credentials or environment access via cryptocurrency (USDT, Ethereum).\u003c/li\u003e\n\u003cli\u003eThreat actors deploy Storm-2990 phishing kits (CoGUI, Haozi, or Iron Man System) into the purchased cloud environments.\u003c/li\u003e\n\u003cli\u003eActors distribute high-volume phishing emails and SMS messages masquerading as trusted brands.\u003c/li\u003e\n\u003cli\u003eVictims interact with phishing lures and are directed to credential harvesting portals.\u003c/li\u003e\n\u003cli\u003eStolen credentials are collected and potentially sold for further unauthorized access or financial fraud.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe ecosystem has enabled over one billion phishing and SMS messages targeting more than 75,000 organizations worldwide. Primary sectors impacted include healthcare, financial services, wholesale distribution, and information technology. The use of fraudulently acquired legitimate infrastructure significantly lowers the barrier to entry for attackers, increasing the volume of credential theft and subsequent fraud losses.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor cloud tenant logs for suspicious new administrative accounts or unauthorized workspace provisioning, especially those associated with domains matching known organizational patterns.\u003c/li\u003e\n\u003cli\u003eImplement strict multi-factor authentication (MFA) policies that require phishing-resistant hardware keys, as the kits target credential harvesting.\u003c/li\u003e\n\u003cli\u003eReview cloud environment activity logs for spikes in administrative or configuration changes that deviate from established baselines for your organization's cloud tenancy.\u003c/li\u003e\n\u003cli\u003eEducate users on the increasing prevalence of SMS-based phishing (smishing) originating from infrastructure that may appear legitimate.\u003c/li\u003e\n\u003cli\u003eDeploy proactive email filtering to scan for phishing links that utilize compromised cloud-based file sharing or hosting services rather than known malicious domains.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-14T16:17:32Z","date_published":"2026-10-14T16:17:32Z","id":"https://feed.craftedsignal.io/briefs/2026-10-phishing-ecosystem/","summary":"Microsoft disrupted a Chinese-language cybercriminal ecosystem where Storm-3119 provided illicit cloud infrastructure to Storm-2990, whose phishing kits facilitated large-scale credential theft globally.","title":"Global Phishing-as-a-Service Ecosystem Disruption","url":"https://feed.craftedsignal.io/briefs/2026-10-phishing-ecosystem/"}],"language":"en","title":"CraftedSignal Threat Feed - Iab","version":"https://jsonfeed.org/version/1.1"}