Microsoft helped shut down an “App Store” for criminals linked to over a billion malicious messages

Microsoft collaborated with the Japanese National Police Agency to tackle Chinese-language cybercrime “app stores” The YAM Store, CoGUI, and Iron Man have targeted people in more than 150 countries Microsoft is working with law enforcement agencies worldwide to take down illegal operations that target businesses and individuals Microsoft has announced a successful operation with the Japanese National Police Agency in which a collection of cybercrime app stores were disrupted.

Investigating fraudulent, scam messages targeting Japanese businesses and citizens, the operation uncovered a multi-faceted criminal marketplace, with three key elements.

The YAM Store, CoGUI, and Iron Man had targeted 75,000 organizations across more than 150 countries worldwide, sent over one billion malicious communications promoting scams, and generated millions of dollars for the criminals behind them.

Furthermore, 750 million messages were aimed at Microsoft’s own customers.

Alongside the Japanese authorities, Cloudflare, Oracle, Proofpoint, Resecurity, and TRM Labs were also involved in the operation.

Impersonation templates Exploring the cybercrime ecosystem targeting Japanese businesses, investigators found the trio of the YAM Store, CoGUI, and Iron Man.

Investigators found these provided a route into a cybercrime ecosystem for cybercriminals.

The environment was providing criminals with pre-fabricated fake websites and messages, designed to be used to fool targets into thinking they were interacting with the genuine article.

Amazon was among the faked sites, on sale so scammers could simply host convincing pages to steal login and payment credentials, without any need to hire their own coder.

Other spoofs on sale included government agencies, financial institutions, and other well-known companies.

Security filtering software was initially unable to handle the CoGUI phishing-as-a-service (Phaas) framework as it employed some sophisticated methods to avoid detection, including browser fingerprinting and geofencing.

What is interesting to note is the role these facilities played for the distribution of cybercrime assets.

CoGUI was apparently targeting Japan and US victims, but during the course of the investigation, was replaced by a new service, Iron Man.

The YAM Store While all three components were already known to Microsoft and the authorities, it took a concerted effort to infiltrate the network of cybercriminals using the services.