Microsoft and JC3 report disruption of YAM Store-linked services

On October 14, Microsoft and the Japan Cybercrime Control Center (JC3) report that a court-authorized operation has seized and redirected domains powering YAM Store, CoGUI and Iron Man System. Microsoft says it has disabled more than 20,000 YAM Store-associated accounts and is blocking more than 100,000 domains used for impersonation and fraud. It describes the broader dismantling effort as ongoing. (Microsoft; JC3)

The action targets connected parts of a phishing services marketplace: Microsoft describes YAM Store as an access broker that supplied compromised or fraudulently obtained cloud environments, accounts, licenses and storage. It links CoGUI, Haozi and Iron Man System to the phishing-kit activity it tracks as Storm-2990, while tracking YAM Store as Storm-3119. (Microsoft’s technical report)

What the reported disruption involved

Microsoft and JC3 say domains powering the services were seized and redirected under an order from the U.S. District Court for the Southern District of Florida. Microsoft also reports disabling YAM Store-associated accounts and blocking domains used for impersonation and fraud. Those measures target both access to the marketplace and infrastructure used in phishing campaigns; Microsoft says dismantling work is continuing.

The investigation began after Japan’s National Police Agency alerted Microsoft to messaging campaigns aimed at people in Japan in late 2025, according to Microsoft. JC3 later supplied information about impacts in Japan and operational intelligence. That path took investigators from specific campaigns to a broader service network supplying tools and cloud resources to downstream operators. (Microsoft; JC3)

What the reported numbers count

Microsoft and JC3 say the services enabled more than 1 billion malicious messages targeting more than 75,000 organizations worldwide since January 2026. Microsoft separately says more than 750 million messages were geared toward its customers; that figure is a subset of the overall message total, not an additional volume. The organizations’ statements also report targets in more than 150 countries. (Microsoft; JC3)

These are figures reported by Microsoft and JC3. The two organizations also report more than 20,000 accounts disabled and more than 100,000 domains blocked, but those disruption counts measure actions taken—not the number of victims or successful attacks.

What the civil case says

A Microsoft-hosted pleadings notice identifies Microsoft Corporation and Health-ISAC, Inc. as plaintiffs, and Yang Jian d/b/a Yam Store, Inc. and Does 1–10 as defendants. It says Microsoft alleges unlawful deception, unauthorized computer intrusion and intellectual-property violations, and says Microsoft obtained a temporary restraining order while seeking further injunctive relief and damages. (Pleadings notice)

Resecurity’s separate Iron Man analysis

Resecurity says it purchased an Iron Man license and deployed the kit in an isolated lab. Its catalog snapshot through October 1, 2026, contained 2,360 entries across 130 target areas and 242 country or locale codes; the company also reports 911 published build versions. Resecurity’s work covered its lab deployment, not production victim systems or live buyer deployments. (Resecurity)

Microsoft separately reports more than 2,335 Iron Man templates tailored to more than 139 countries. The figures describe different measures: Resecurity reports catalog entries and target areas, while Microsoft reports templates and countries.

Steps Microsoft recommends

Microsoft recommends checking unexpected requests through a trusted channel rather than following a message link. For organizations, its guidance includes passkeys and multifactor authentication, least-privilege access, Conditional Access, and email and network protections. It also cautions that a brand or public agency appearing in a phishing template is not, by itself, evidence that the organization’s systems were compromised. (Microsoft’s security guidance)