Microsoft Disrupts Chinese-Language Phishing Ecosystem Storm-2990

Microsoft Security researchers have disclosed the disruption of a significant Chinese-language cybercriminal ecosystem. The company’s Digital Crimes Unit tracked the operation, which involved an interconnected network of phishing kit operators labeled Storm-2990 and an illicit marketplace identified as Storm-3119. These groups sold the digital tools and infrastructure required to execute large-scale phishing campaigns globally, according to the Microsoft Security Blog post dated October 14, 2026.

The investigation revealed that Storm-2990 and Storm-3119 functioned as a cohesive unit. The operators provided the necessary components for cybercriminals to conduct widespread attacks. Microsoft Security researchers described this arrangement as a hidden network that powered global cybercrime by centralizing the sale of phishing kits and supporting infrastructure. The firm stated that this ecosystem allowed attackers to easily access the resources needed for their operations.

Context and Background

Microsoft’s Digital Crimes Unit led the research into this specific threat landscape. The team focused on understanding how the phishing kit operators and the marketplace interacted to sustain the cybercrime economy. By analyzing the digital footprints left by these groups, researchers were able to map the connections between the various actors involved in the network. This detailed mapping allowed for a coordinated response with external partners.

The collaboration extended beyond Microsoft’s internal teams. The company worked alongside law enforcement agencies and other partners located worldwide to address the threat. This international cooperation was essential for facilitating the disruption of the ecosystem. The joint effort targeted the infrastructure that supported the phishing operations, aiming to degrade the capability of the actors tracked as Storm-2990 and Storm-3119.

Who is Affected

The primary impact of this disruption falls on the cybercriminal ecosystem itself. The operators known as Storm-2990 and the marketplace Storm-3119 faced direct action from the coordinated effort. By disrupting the supply chain for phishing tools, the initiative aimed to hinder the ability of these groups to continue their activities. The specific victims of the phishing campaigns were not detailed in the public disclosure by Microsoft.

Organizations that may have been targeted by tools sold through Storm-3119 remain at risk if similar networks emerge. The nature of phishing infrastructure means that attackers often pivot to new platforms or identities after a disruption. Security professionals should remain vigilant for new indicators associated with Chinese-language phishing operations, as the underlying criminal intent persists despite the removal of this specific infrastructure.

What should you do?

Security teams should monitor for new phishing kits or infrastructure that may be linked to displaced operators from Storm-2990. Since the ecosystem was disrupted, residual elements or successor groups may attempt to re-establish similar services. Analysts should look for changes in phishing kit distribution channels or new marketplace domains that mirror the functionality of Storm-3119. Maintaining strict email security policies remains critical in this evolving landscape.

What to do and how to stay safe: Microsoft

• Monitor email traffic for new phishing kits that may originate from displaced operators formerly associated with Storm-2990.
• Review logs for connections to infrastructure domains that were previously linked to the Storm-3119 marketplace.
• Update detection rules to identify new indicators of compromise related to Chinese-language phishing campaigns.
• Train users to recognize phishing attempts that leverage newly acquired infrastructure from disrupted criminal networks.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What were the tracked names for the phishing operators and the marketplace?

The phishing kit operators were tracked as Storm-2990, and the illicit marketplace selling tools was tracked as Storm-3119.

Did Microsoft dismantle the entire network completely?

No, Microsoft stated that it facilitated a disruption of the ecosystem in collaboration with law enforcement and partners.

What language was primarily used in this cybercriminal ecosystem?

The ecosystem was described as a Chinese-language cybercriminal network by Microsoft Security researchers.