• Microsoft collaborated with the Japanese National Police Agency to tackle Chinese-language cybercrime “app stores”
• The YAM Store, CoGUI, and Iron Man have targeted people in more than 150 countries
• Microsoft is working with law enforcement agencies worldwide to take down illegal operations that target businesses and individuals

Microsoft has announced a successful operation with the Japanese National Police Agency in which a collection of cybercrime app stores were disrupted. Investigating fraudulent, scam messages targeting Japanese businesses and citizens, the operation uncovered a multi-faceted criminal marketplace, with three key elements.

The YAM Store, CoGUI, and Iron Man had targeted 75,000 organizations across more than 150 countries worldwide, sent over one billion malicious communications promoting scams, and generated millions of dollars for the criminals behind them. Furthermore, 750 million messages were aimed at Microsoft’s own customers.

Alongside the Japanese authorities, Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs were also involved in the operation.

Impersonation templates

Exploring the cybercrime ecosystem targeting Japanese businesses, investigators found the trio of the YAM Store, CoGUI, and Iron Man. Investigators found these provided a route into a cybercrime ecosystem for cybercriminals.

The environment was providing criminals with pre-fabricated fake websites and messages, designed to be used to fool targets into thinking they were interacting with the genuine article. Amazon was among the faked sites, on sale so scammers could simply host convincing pages to steal login and payment credentials, without any need to hire their own coder. Other spoofs on sale included government agencies, financial institutions, and other well-known companies.

Security filtering software was initially unable to handle the CoGUI phishing-as-a-service (Phaas) framework as it employed some sophisticated methods to avoid detection, including browser fingerprinting and geofencing.

What is interesting to note is the role these facilities played for the distribution of cybercrime assets. CoGUI was apparently targeting Japan and US victims, but during the course of the investigation, was replaced by a new service, Iron Man.

The YAM Store

While all three components were already known to Microsoft and the authorities, it took a concerted effort to infiltrate the network of cybercriminals using the services. They were hosted in a wholly Chinese-language environment, requiring native-speakers to be added to the investigating team, and gain access to the underground cybercrime marketplace known as the YAM Store.

Microsoft assigned a tracking number Storm-3119 to the marketplace, which it describes as an “Initial Access Broker.” It was set up to provide its customers with “compromised or fraudulently obtained environments in providers like Microsoft and Google.”

While it may be expected for compromised software to be on the radar of its publishers, the creator(s) of the YAM Store had a workaround. It was able to keep its inventory fresh by using automation. This identified “expired environment or organization names and leverages legitimate customer information associated with them to help circumvent existing detections.”

Microsoft has seized domains associated with the YAM/CoGUI/Iron Man infrastructure, and either blocked or redirected them.