Microsoft Takes Down USDT-Funded Phishing Network Targeting 75,000 Companies

Microsoft, working in tandem with the cybersecurity group Health-ISAC, has secured a court order from the US to seize and redirect domains that provided critical support to three specific cybercrime services known as YAM Store, CoGUI, and Iron Man.

The takedown, which was announced on Oct. 14, effectively disabled more than 20,000 accounts that were linked to YAM Store and blocked a total of over 100,000 domains used for fraud and impersonation. According to the investigation, the network generated tens of millions of dollars for the operators who ran it by facilitating the delivery of more than one billion malicious messages since January. This wide-reaching operation targeted more than 75,000 organizations located across more than 150 different countries.

Investigation Origins and Scope

The probe was initiated after the National Police Agency of Japan alerted Microsoft late last year regarding scams that were targeting both businesses and consumers. Investigators eventually traced these campaigns back to a market conducted in the Chinese language, where various criminal groups could purchase the infrastructure required to run phishing operations without the need to build such systems themselves. This specific marketplace model enabled fraudsters to scale their illicit operations rapidly by granting them access to compromised credentials and pre-built tools.

YAM Store acted as a supplier of hosting, cloud resources, and Microsoft and Google accounts that had been fraudulently obtained. In some instances, operators revived domains that had expired and previously belonged to educational organizations and nonprofits, using these seemingly legitimate websites to obtain Microsoft 365 accounts for the purpose of resale. Meanwhile, Iron Man and CoGUI supplied messages and phishing pages that were ready-made to mimic government agencies, transport authorities, retailers, and banks. Microsoft and the security firm Resecurity identified more than 2,300 templates from Iron Man, which allowed the customers of the service to tailor their scams to specific countries and brands.

Crypto Payments and Asset Freezing

Technical investigations conducted by Microsoft found that these services accepted various forms of cryptocurrency, including Ethereum and Tether’s USDT. The storefront for YAM Store supported USDT on the Tron network, while also accepting WeChat Pay and Alipay. Cloudflare further stated that buyers had the option to pay for marketplace offerings using USDC. These diverse payment options provided the customers with multiple channels to purchase phishing services and compromised credentials without having to rely on traditional banking systems.

To expand the distribution of infrastructure and accounts beyond its own storefront, YAM Store maintained a sub-reseller tier. This hierarchical structure allowed the network to reach a much wider base of potential buyers. TRM Labs, a blockchain analytics firm, stated that its intelligence helped investigators locate and freeze assets linked to the group. While the company did not specify the exact value of the frozen assets, the immediate financial damage of the operation remains unclear. This lack of a specific figure highlights the inherent difficulty in quantifying the economic impact of distributed cybercrime operations of this nature.

Infrastructure Disruption and Next Steps

The enforcement effort focused on the services that criminals utilized after their purchases were complete. Cloudflare banned hundreds of associated projects and domains, disabled Workers projects that supported phishing pages, and suspended accounts. In cases where it could not seize domains directly, it placed warning pages in front of malicious links. This specific approach is intended to neutralize the threat even in situations where legal jurisdiction is limited.

Microsoft identified a critical dependency within the subscription business of Iron Man. Customers purchased access to phishing software that was connected to a licensing server controlled by the vendor. By disabling that infrastructure, authorities could interfere with the ability of customers to use the kits they purchased, even if copies of the software remained in circulation. The crackdown involved the Cybercrime Control Center and Japan’s police, alongside partners from US law enforcement, Proofpoint, Oracle, Resecurity, and others.

Microsoft stated that the suppliers targeted were part of a larger criminal network and that related infrastructure is still in the process of being removed. Cloudflare noted that some domain registrars operate in jurisdictions that make legal seizures difficult, which requires the company to block access via security warnings while the domains remain online. The next challenge involves limiting the speed with which suppliers can replace compromised accounts and seized domains. Authorities are continuing to monitor the network for any new infrastructure that may emerge as a response to the takedown.