Storm-3119

Storm-3119, also known as YAM Store, is a financially motivated cybercriminal marketplace and initial access broker that sells compromised or fraudulently obtained Microsoft and Google cloud environments, credentials, accounts, licenses, and storage. Its automated storefront supports downstream resellers and supplies infrastructure for phishing and financial fraud. Organizations affected through this ecosystem include healthcare, financial services, wholesale distribution, and information technology businesses in Japan, the United States, Australia, and India. Its cloud offerings also include educational and nonprofit environments. The group uses automated reconnaissance tooling and Tor to discover Microsoft 365 tenants, assess enrollment opportunities, and collect licensing and Azure information. It acquires expired organizational domains, reconstructs websites, and reuses legitimate organizational identities to obtain cloud accounts fraudulently. Within compromised environments, Storm-3119 uses stolen application client secrets and application-only authentication to reset passwords, assign licenses, and manipulate privileged directory attributes. It also abuses compromised Global Administrator accounts to provision service principals with broad Microsoft Graph and SharePoint permissions, establishing persistent application-level access independent of individual user sessions. Storm-3119 converts compromised SharePoint and OneDrive storage into bulk hosting services for resale and centrally manages phishing infrastructure, certificates, and routing. YAM Store distributes the CoGUI, Haozi, and Iron Man System phishing kits. Their developers and associated activity are tracked separately as Storm-2990, rather than as a subgroup or alias of Storm-3119. The marketplace supports cryptocurrency payments and uses Telegram for customer communications and order notifications.