[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

4 clusters · 12 sources · 5 days · First seen · Last updated

Microsoft and Japanese police dismantle cybercrime network

Overview

Microsoft, in collaboration with Japan’s National Police Agency and the Health Information Sharing and Analysis Center (Health-ISAC), has successfully dismantled a transnational cybercrime network through domain seizures and account bans. A U.S. court order facilitated the disruption of three major infrastructure components: YAM Store, CoGUI, and Iron Man.

Since January 2026, these platforms enabled more than one billion malicious messages targeting over 75,000 organizations across more than 150 countries, including medical institutions and financial entities. Of these, over 750 million messages specifically targeted Microsoft customers. The operations, which generated tens of millions of dollars in illegal revenue, utilized YAM Store as a marketplace for fraudulent Microsoft and Google accounts, CoGUI for impersonating legitimate agencies, and Iron Man as a “phishing-kit-as-a-service” offering over 2,300 pre-built lure templates tailored for countries such as Australia, Japan, and India.

In Japan, the National Police Agency reported that approximately half of the 120,000 fraudulent websites targeting Japanese companies identified in 2025 were created using these specific kits. In response to the crackdown, Microsoft has banned over 20,000 associated accounts and intercepted more than 100,000 fraudulent domains. As part of the enforcement, Microsoft has also taken control of and redirected the domains supporting these criminal platforms.

Recent coordinated efforts involving the U.S. Department of Justice and the FBI have further expanded the scope of international disruptions. Authorities seized domains associated with Integrity Technology Group, a firm accused of using tools like ‘Microscan’ to scout vulnerabilities in critical infrastructure, including airports in Japan and Poland, and utility companies in Taiwan. The group also utilized ‘FishHub’ for spear-phishing and unauthorized remote access.

Entities

YAM Store · Health-ISAC · Microsoft · National Police Agency · CoGUI

Timeline

  1. [TECHNOLOGY] 2 sources
    US and Microsoft disrupt global cybercrime infrastructure

    US authorities and Microsoft have dismantled major cybercrime infrastructures, targeting Chinese-linked tools and a global phishing ecosystem that sent over one billion malicious messages.

  2. [TECHNOLOGY] 3 sources
    Microsoft takes legal action against billion-scale botnets

    Microsoft secured a US court order to dismantle botnet infrastructures responsible for over one billion malicious messages and deactivated 20,000 accounts.

  3. [TECHNOLOGY] 4 sources
    Microsoft and Japanese police dismantle global phishing network

    Microsoft and the Japanese National Police Agency dismantled a global phishing network, YAM Store, which sent over 1 billion malicious messages and targeted 75,000 organizations worldwide.

  4. [TECHNOLOGY] 3 sources
    Microsoft disrupts major cybercrime network via domain seizures

    Microsoft and partners seized domains for YAM Store, CoGUI, and Iron Man, disrupting a cybercrime network that sent over one billion malicious messages targeting 75,000 organizations worldwide.

Sources

ad-hoc-news.de · administrator.de · ascii.jp · atmarkit.co.jp · blogspan.net · flagthis.com · fnn.jp · hackread.com · internet.watch.impress.co.jp · ithome.com · news.mynavi.jp · therecord.media

This summary has been updated 2 times: see revision history