[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fQGmhyh74cpjFHsH6iF7KopPRyiMFJPqs1OX9NiM8Xy4":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"d6009899-02f7-4393-8670-798be83291f9","The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime","the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global--213315","Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In collaboration with law enforcement agencies and other partners worldwide, Microsoft’s Digital Crimes Unit (DCU) facilitated a disruption of the ecosystem. The post The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime appeared first on Microsoft Security Blog.","Microsoft has uncovered and disrupted a large Chinese-language cybercriminal ecosystem involving phishing kit operators (Storm-2990) and an illicit marketplace (Storm-3119) that sold tools and infrastructure for large-scale phishing. These kits, including CoGUI, Haozi, and Iron Man System, have facilitated over a billion phishing emails and SMS messages since January 2026, targeting organizations globally. The ecosystem's disruption was a collaborative effort with law enforcement.","Microsoft disrupts Chinese-language phishing kit ecosystem and illicit marketplace.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F10\u002F14\u002Fthe-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FStorm-3119-and-Storm-2990-featured.png","2026-10-14T13:00:00+00:00","2026-10-14T14:00:16.31487+00:00",8,[17,20,22,25,27,29],{"name":18,"type":19},"Storm-2990","threat_actor",{"name":21,"type":19},"Storm-3119",{"name":23,"type":24},"Microsoft Defender","product",{"name":26,"type":24},"Microsoft Defender for Endpoint",{"name":28,"type":24},"Microsoft Defender for Identity",{"name":30,"type":31},"Microsoft","vendor","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[],[30,23,26],{"controls":46,"vendors":130},[47,74,102],{"slug":48,"name":49,"problem":50,"products":51},"email-authentication","Email authentication (DMARC)","Nobody can send email that pretends to come from your domain.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"valimail","Valimail","\u002Fvendor-logos\u002Fvalimail.png","valimail-enforce","Valimail Enforce","https:\u002F\u002Fwww.valimail.com\u002Fproducts\u002Fenforce\u002F","Automated DMARC enforcement with discovery of every service that sends mail as your domain.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"red-sift","Red Sift","\u002Fvendor-logos\u002Fred-sift.png","ondmarc","Red Sift OnDMARC","https:\u002F\u002Fredsift.com\u002Fpulse-platform\u002Fondmarc","Guided DMARC deployment and monitoring, with support for BIMI and MTA-STS.",{"vendor_slug":69,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":69,"url":72,"description":73},"dmarcian","\u002Fvendor-logos\u002Fdmarcian.png","dmarcian-platform","https:\u002F\u002Fdmarcian.com\u002F","DMARC report processing and guidance for moving domains to enforcement.",{"slug":36,"name":75,"problem":76,"products":77},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[78,86,94],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":103,"name":104,"problem":105,"products":106},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":124,"vendor_name":30,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[131],{"slug":124,"name":30,"logo_path":125,"roles":132},[133],"reported_by",{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":149},"billion-email-phishing-ecosystem-highlights-the-scale-of-industrialized-cybercrime","Billion-Email Phishing Ecosystem Highlights the Scale of Industrialized Cybercrime","Microsoft uncovered a sophisticated Chinese-language cybercriminal marketplace where operators (Storm-2990 and Storm-3119) sold ready-made phishing kits, infrastructure, and tooling as a service — enabling low-skill actors to launch massive campaigns with minimal effort. The ecosystem facilitated over one billion phishing emails and SMS messages in under a year, demonstrating how commoditized crime platforms dramatically lower the barrier to entry for attackers. The root problem is that organizations and individuals remain vulnerable to well-crafted phishing lures, especially when attackers have access to polished, professionally maintained toolkits. This matters because even a single successful phishing attempt can grant attackers an initial foothold for credential theft, ransomware, or espionage. Disruption required cross-sector collaboration, underscoring that no single organization can combat industrialized cybercrime alone.",[139,140,141,142,143,144,145,146,147,148],"CIS Control 9 – Email and Web Browser Protections","CIS Control 14 – Security Awareness and Skills Training","CIS Control 17 – Incident Response Management","NIST SP 800-53 SI-8 – Spam Protection","NIST SP 800-53 AT-2 – Literacy Training and Awareness","NIST SP 800-53 IR-4 – Incident Handling","NIST Cybersecurity Framework – Detect (DE.CM-1)","GDPR Article 32 – Security of Processing","ITIL 4 – Service Configuration Management \u002F Continual Improvement","DMARC RFC 7489 – Domain-based Message Authentication",{}]