Microsoft helped shut down a criminal “App Store” linked to more than a billion malicious messages
follow us
Add us as a preferred source on Google
- Microsoft Collaborated with Japan’s National Police Agency to Address Chinese-Language Cybercrime “App Stores”
- The YAM Store, CoGUI, and Iron Man have reached people in over 150 countries.
- Microsoft is working with law enforcement agencies around the world to crack down on illegal operations targeting businesses and individuals.
Microsoft has announced a successful operation with Japan’s National Police Agency in which a number of cybercrime app stores were disrupted. By investigating fraudulent and fraudulent messages targeting Japanese businesses and citizens, the operation uncovered a multifaceted criminal market, with three key elements.
YAM Store, CoGUI and Iron Man targeted 75,000 organizations in more than 150 countries worldwide, sent more than one billion malicious communications promoting scams, and generated millions of dollars for the criminals behind them. Additionally, 750 million messages were directed to Microsoft’s own customers.
In addition to the Japanese authorities, Cloudflare, Oracle, Proofpoint, Resecurity and TRM Labs also participated in the operation.
Latest videos ofTechnologyRadar
Impersonation templates
When exploring the cybercrime ecosystem targeting Japanese companies, researchers found the trio of YAM Store, CoGUI, and Iron Man. Researchers found that these provided a route into a cybercrime ecosystem for cybercriminals.
The environment provided criminals with prefabricated fake websites and messages, designed to trick targets into believing they were interacting with the genuine article. Amazon was among the fake sites, for sale so scammers could simply host convincing pages to steal login and payment credentials, without needing to hire their own coder. Other parodies for sale included government agencies, financial institutions, and other well-known companies.
Initially, the security filtering software could not handle CoGUI’s Phishing as a Service (Phaas) framework as it employed some sophisticated methods to avoid detection, including browser fingerprinting and geofencing.
What is interesting to note is the role these facilities played in the distribution of cybercrime assets. CoGUI apparently targeted victims in Japan and the United States, but during the course of the investigation it was replaced by a new service, Iron Man.
The YAM store
While Microsoft and authorities were already aware of the three components, it took a concerted effort to infiltrate the network of cybercriminals using the services. They were hosted in an entirely Chinese-language environment, which required native speakers to be added to the investigation team and gain access to the underground cybercrime marketplace known as the YAM Store.
Microsoft assigned a tracking number Storm-3119 to the marketplace, which it describes as an “Initial Access Agent.” It was created to provide its customers with “compromised or fraudulently obtained environments at vendors such as Microsoft and Google.”
While compromised software can be expected to be on the radar of its publishers, the creators of the YAM Store had a solution. You were able to keep your inventory up to date by using automation. This identified “expired environment or organization names and leverages legitimate customer information associated with them to help bypass existing detections.”
Microsoft has taken over domains associated with the YAM/CoGUI/Iron Man infrastructure and blocked or redirected them.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment