Microsoft and Health-ISAC have seized and redirected domains used by YAM Store, CoGUI and Iron Man, three components of a Chinese-language cybercrime marketplace that supplied criminals with accounts, phishing kits and infrastructure.
The action was based on an order from the US District Court for the Southern District of Florida. Health-ISAC joined the civil lawsuit after threat actors frequently leveraged the cybercrime infrastructure to target hospitals and healthcare organizations.
According to Microsoft, the three services were used to send more than one billion malicious messages since January 2026. The messages targeted consumers and over 75,000 organizations in more than 150 countries, and over 750 million of them were aimed at Microsoft customers. The operators made tens of millions of dollars.
The company has disabled over 20,000 accounts tied to YAM Store and is blocking more than 100,000 domains used for impersonation and fraud.
The investigation began in late 2025, when Japan’s National Police Agency alerted Microsoft to malicious messaging campaigns targeting people in the country. Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs later joined the effort, along with US and international law enforcement.
“What began with scam activity targeting people and organizations in Japan led investigators to an underground service economy supplying criminals around the world. YAM Store, CoGUI and Iron Man are only part of that larger criminal network, but disrupting them makes it harder for criminals to obtain the accounts, tools and infrastructure they rely on,” wrote Steven Masada, general manager of Microsoft’s Digital Crimes Unit.
YAM Store, CoGUI and Iron Man
Microsoft tracks YAM Store as Storm-3119. The marketplace sold infrastructure built on compromised or fraudulently obtained environments at providers such as Microsoft and Google. Buyers could choose based on age, subscription type and environment type, such as education or nonprofit.