Loading threat actor…
Storm-2990 is Microsoft's collective tracking designation for the Chinese-speaking developers and associated activity behind the commercially licensed phishing-as-a-service kits CoGUI, Haozi, and Iron Man System. CoGUI is also known as NX or FA, while Haozi is also known as Phoenix. The kits are sold through YAM Store, an infrastructure marketplace separately tracked as Storm-3119. Storm-2990 supports financially motivated cybercrime; its developers' use of Chinese does not establish a country of origin or state sponsorship. Since January 2026, actors behind these kits have facilitated more than one billion phishing emails and SMS messages targeting over 75,000 organizations worldwide. Prominent targets include organizations in Japan, the United States, Australia, and India, particularly healthcare providers, financial services companies, wholesale distributors, and information technology firms. Downstream operators use stolen credentials and payment information for account compromise, fraudulent purchases, and other financial fraud. The kits provide localized templates impersonating trusted brands, government authorities, banks, retailers, healthcare providers, and transportation services. Lures include unpaid tolls, traffic fines, delivery problems, account verification requests, and overdue payments. Iron Man System offers more than 2,300 phishing templates. Interactive harvesting uses WebSocket connections and Telegram notifications to transmit credentials, payment information, and verification codes, allowing operators to monitor victims and control subsequent phishing screens. Associated campaigns also employ device-code phishing to obtain authentication tokens and access accounts. Geofencing, IP-based allowlists and blocklists, fake CAPTCHA gates, and anti-analysis settings obstruct automated scanning and security research. In October 2026, Microsoft, Health-ISAC, law enforcement, and industry partners disrupted supporting infrastructure, including court-authorized seizure and redirection of domains associated with CoGUI, Iron Man System, and YAM Store.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 malware families attributed to this actor across reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.