Key points
- Microsoft identified an interconnected network of phishing kit operators tracked as Storm-2990.
- An illicit marketplace tracked as Storm-3119 sold infrastructure for large-scale phishing campaigns.
- The disruption was facilitated by Microsoft’s Digital Crimes Unit alongside global law enforcement partners.
Microsoft’s Digital Crimes Unit facilitated the disruption of a Chinese-language cybercriminal ecosystem that provided infrastructure for global phishing campaigns. This operation targeted an interconnected network of operators tracked as Storm-2990 and an associated illicit marketplace known as Storm-3119. The action involved collaboration with law enforcement agencies and other partners worldwide to dismantle the tools and services these groups were selling.
The ecosystem facilitated large-scale phishing by providing ready-made kits and hosting infrastructure to criminal actors. According to Microsoft Security, the network was deeply interconnected, allowing operators to share resources and scale their malicious activities efficiently. The disruption aims to remove these critical enablers from the cybercrime landscape, cutting off supply lines for attackers who rely on commercialised phishing tools.
Operational Context
The investigation revealed how Storm-2990 operators functioned within a broader commercialised threat model. Rather than building phishing infrastructure from scratch, attackers could purchase pre-configured kits and hosting services from the Storm-3119 marketplace. This commodification of attack infrastructure lowers the barrier to entry for cybercriminals, enabling less sophisticated actors to launch large-scale campaigns. Microsoft’s analysis focused on mapping these connections to understand the full scope of the network’s reach and its support mechanisms.
Affected Entities
The disruption primarily impacts the cybercriminal infrastructure providers tracked as Storm-2990 and Storm-3119. These entities served as suppliers to various phishing campaigns targeting users globally. While specific victims were not detailed in the report, the nature of large-scale phishing kits suggests broad exposure across multiple sectors. Security teams monitoring these threat groups should expect immediate changes in the availability of these specific tools and hosting services.
What happens next
Microsoft has confirmed the disruption of the ecosystem through its Digital Crimes Unit. Law enforcement agencies worldwide participated in the operation, ensuring a coordinated takedown of the infrastructure. No further technical details about future enforcement actions were provided in the initial report. Organisations should continue monitoring for any resurgence of similar infrastructure or new threat groups adopting the vacated operational model.
Why this attack works
Phishing infrastructure ecosystems succeed by commodifying attack tools. They reduce the technical skill required to launch campaigns by selling pre-built kits and hosting. This model relies on the separation of development from execution, allowing criminals to focus on delivery rather than creation. Teams usually mitigate this by monitoring for known kit signatures and unusual hosting patterns. Check whether your email filters detect common phishing kit templates. Analyse traffic for connections to newly registered domains often used by such infrastructure. Focus on user training to recognise generic phishing attempts that these kits typically generate.
What to do and how to stay safe: Microsoft
- Monitor email gateways for traffic originating from newly registered domains associated with known phishing kits.
- Review security logs for connections to infrastructure previously linked to Storm-2990 or Storm-3119.
- Update user awareness training to include examples of phishing templates commonly sold in these marketplaces.
- Verify that email authentication protocols like SPF and DKIM are strictly enforced to block spoofed messages.
Step-by-step guide: Security Awareness Training: How Human Behaviour Shapes Defence
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who are the threat actors involved in this disruption?
The operators are tracked as Storm-2990, and the associated marketplace is tracked as Storm-3119.
Did Microsoft act alone to disrupt this network?
No, Microsoft collaborated with law enforcement agencies and other partners worldwide.
What type of cybercrime does this ecosystem support?
It supports large-scale phishing campaigns by selling tools and infrastructure.
