Key points
- Microsoft tracked the phishing operators as Storm-2990 and the tool marketplace as Storm-3119.
- The disruption involved collaboration with global law enforcement agencies and partners.
- The ecosystem facilitated large-scale phishing by selling infrastructure and kits.
Microsoft has disrupted an interconnected cybercriminal ecosystem that operated primarily in Chinese. The Digital Crimes Unit identified the group of phishing kit operators as Storm-2990 and the associated illicit marketplace as Storm-3119, which sold infrastructure for large-scale phishing campaigns.
According to Microsoft Security, this network provided the tools and infrastructure necessary for cybercriminals to conduct widespread phishing attacks. The disruption was facilitated through collaboration with law enforcement agencies and other partners worldwide, targeting the supply chain of illicit digital assets rather than just individual campaigns.
The hidden network structure
The source material describes an ecosystem where operators and a marketplace functioned together. Storm-2990 refers to the phishing kit operators, while Storm-3119 is the marketplace selling these tools. This structure allowed for the distribution of infrastructure used in global cybercrime efforts.
Microsoft’s report highlights that this was not merely a single group but a network of interconnected elements. By targeting the marketplace and the operators together, the intervention aimed to break the cycle of tool distribution and phishing campaign execution.
Who is affected
The disruption impacts users who may have been targeted by phishing campaigns using tools from this network. Since the ecosystem supported large-scale phishing, individuals and organisations globally could have encountered fraudulent communications generated by these kits.
Security teams should be aware that the tools sold through Storm-3119 were designed for broad deployment. Affected parties are those who interacted with phishing attempts facilitated by this infrastructure, though specific victim counts are not detailed in the source material.
Our take on the response
The coordinated effort underscores the importance of targeting cybercriminal infrastructure. By disrupting the marketplace and operators simultaneously, Microsoft and partners aim to reduce the availability of these illicit tools. This approach suggests a shift towards dismantling the underlying support systems of cybercrime networks.
What affected people can do
Organisations should review recent phishing reports to identify any campaigns that may have utilised infrastructure from this disrupted network. Teams usually monitor for changes in attacker tactics following such disruptions. Users should remain vigilant against sophisticated phishing attempts and verify the authenticity of unexpected communications. It is advisable to ensure that security awareness training covers the recognition of evolving phishing techniques and to report suspicious emails promptly to the security operations team for analysis.
What to do and how to stay safe: Microsoft
- Monitor email logs for any recent phishing attempts that may have originated from infrastructure linked to Storm-2990 or Storm-3119.
- Update phishing detection rules to look for new indicators of compromise that may emerge as attackers adapt to the disruption.
- Educate staff on recognising phishing attempts that may use different linguistic or visual cues after the primary network is disrupted.
- Ensure that incident response plans include procedures for handling large-scale phishing campaigns that utilise stolen credentials or fraudulent infrastructure.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What are the names of the groups Microsoft disrupted?
Microsoft tracked the phishing kit operators as Storm-2990 and the illicit marketplace as Storm-3119.
Who did Microsoft collaborate with for this disruption?
Microsoft collaborated with law enforcement agencies and other partners worldwide.
What kind of tools were sold in this ecosystem?
The ecosystem sold tools and infrastructure for large-scale phishing campaigns.