Microsoft and Health-ISAC disrupt YAM Store, CoGUI and Iron Man

Microsoft and Health‑ISAC [announced the disruption on October 14](https://blogs.microsoft.com/on‑the‑issues/2026/10/14/disrupting‑the‑service‑economy‑behind‑transnational‑cybercrime‑operations/) after an investigation that began with scam campaigns in Japan. The operation targets YAM Store, CoGUI and Iron Man: services accused of supplying cloud accounts, hosting and ready‑made phishing material to other criminals. The [public notice of pleadings](https://www.microsoft.com/en‑us/corporate‑responsibility/customer‑security‑trust/digital‑crimes‑unit/notice‑of‑pleadings/yam‑cogui‑ironman/) identifies the case as *Microsoft Corporation and Health‑ISAC, Inc. v. Yang Jian d/b/a Yam Store, Inc., and Does 1‑10*, Civil Action No. 1:26‑cv‑26998‑JEM in the Southern District of Florida. It says the court granted a temporary restraining order and authorized control or disabling of associated domains while the case proceeds. That legal posture matters. The complaint contains allegations, and the temporary order is an interim remedy rather than a final judgment on every claim.

Microsoft says the three components collectively enabled more than one billion phishing emails and SMS messages since January 2026, targeting more than 75,000 organizations in over 150 countries. It attributes more than 750 million of those messages to campaigns aimed at Microsoft customers. Those figures come from Microsoft’s investigation and threat telemetry. They describe messages linked to the infrastructure, not one billion confirmed victims or successful compromises. The company also says the affected sectors included healthcare, financial services, wholesale distribution and IT. The separate [technical threat‑intelligence report](https://www.microsoft.com/en‑us/security/blog/2026/10/14/the‑hidden‑network‑inside‑the‑phishing‑infrastructure‑ecosystem‑powering‑global‑cybercrime/) names YAM Store as Storm‑3119 and the linked phishing‑kit operators as Storm‑2990.

Microsoft says it has disabled more than 20,000 accounts connected to YAM Store and blocked more than 100,000 domains used for impersonation and fraud. The seizure notice shows participation from Japan’s National Police Agency, JC3, Health‑ISAC, Resecurity, Proofpoint, Cloudflare, Oracle, TRM Labs and law‑enforcement partners. The approach targets shared suppliers rather than one campaign at a time. Taking control of domains interrupts storefronts and infrastructure that multiple buyers can reuse, while account and domain blocks reduce access to the cloud environments used downstream. The announced action does not establish that every operator, customer or copy of the phishing kits has been removed. Criminal buyers can migrate to different vendors or infrastructure.

The public examples include parcel, toll, banking, tax and account‑security messages. They rely on urgency, familiar branding and links that lead to imitation sign‑in or payment pages. A takedown can remove specific domains without eliminating those techniques. Teams should keep current email filtering, domain authentication, phishing‑resistant authentication and user‑reporting paths in place. Incident responders should review alerts tied to the named infrastructure under normal evidence and retention procedures rather than assume the threat disappeared on October 14. The source material says the presence of a brand in a phishing template does not mean that brand’s own systems were compromised.

The most useful follow‑up is operational: watch whether the redirected domains stay controlled, whether Microsoft publishes additional account or domain actions, and whether defenders observe migration to replacement infrastructure. Count verified blocked or remediated assets separately from Microsoft’s estimates of prior message volume. For readers tracking the vendor’s security work, the [Microsoft organization page on OpenTools](https://opentools.ai/organizations/microsoft) collects related product and platform coverage. *Image: Microsoft’s real seizure notice for domains named in the operation. The source‑published image is used for documentary news reporting, with no generated elements or artificial upscaling.*