Disrupting the Service Economy Behind Transnational Cybercrime Operations

In this article for Microsoft’s On the Issues blog, author Steven Masada discusses a joint effort by Microsoft and Health-ISAC to dismantle three cybercrime services: YAM Store, CoGUI, and Iron Man. Following an investigation initiated by Japan’s National Police Agency in late 2025, Microsoft and its partners uncovered a Chinese-language cybercrime marketplace supplying criminals with fraudulent accounts, hosting services, and tools for impersonating trusted organizations. Since January 2026, these services have collectively enabled more than one billion malicious messages targeting over 75,000 organizations worldwide.

The investigation revealed how the three services supported different stages of online fraud. CoGUI provided ready-made websites and messages impersonating businesses, financial institutions, and government agencies to steal credentials and payment information. YAM Store operated as an online marketplace selling fraudulent Microsoft and Google accounts and other tools used in scams. Iron Man expanded these capabilities with more than 2,300 templates impersonating organizations across over 150 countries, enabling criminals to rapidly create convincing phishing emails, text messages, and websites tailored to different brands and regions.

The operation demonstrated the importance of international and cross-sector cooperation in uncovering interconnected cybercriminal networks. Japan’s National Police Agency and the Japan Cybercrime Control Center contributed intelligence and investigative support, while Resecurity, Cloudflare, Oracle, Proofpoint, TRM Labs, and Health-ISAC helped identify the infrastructure and assess the impact across industries. Microsoft also used AI tools to connect accounts, websites, and services that initially appeared unrelated, working alongside U.S. and international law enforcement partners.

Acting under an order from the U.S. District Court for the Southern District of Florida, Microsoft and Health-ISAC seized and redirected domains supporting the three services. Microsoft also disabled more than 20,000 accounts associated with YAM Store and blocked over 100,000 domains used for impersonation and fraud. The authors emphasize that modern scams depend on a broader service economy that enables criminals to reach victims at scale. Disrupting the suppliers and infrastructure behind these operations, rather than targeting individual scam messages alone, is therefore essential to reducing cybercrime…

CONTINUE READING…