Microsoft, Health-ISAC disrupt cybercrime operations targeting healthcare

Microsoft and the Health Information Sharing and Analysis Center have taken action to disrupt cybercrime infrastructure used to target organizations worldwide, including healthcare organizations.

The effort, according to an Oct. 14 report from Microsoft, targeted three components of a Chinese-language cybercrime marketplace.

Here are seven things to know:

1. The three services, known as YAM Store, CoGUI and Iron Man, collectively enabled more than 1 billion malicious messages targeting over 75,000 organizations worldwide since January 2026, Microsoft said. More than 750 million of those messages targeted Microsoft customers.
2. The messages were used to target consumers, healthcare organizations, financial institutions and other businesses in more than 150 countries, generating tens of millions of dollars for their operators.
3. YAM Store sold fraudulent Microsoft and Google accounts and other ready-made tools used to carry out scams, including credential theft. CoGUI supplied ready-made websites and messages impersonating trusted organizations, allowing criminals to quickly deploy pages designed to steal passwords, payment information and other personal data.
4. By mid-2026, CoGUI was increasingly being replaced by Iron Man, which let criminals deploy email, text and web content tailored to specific brands, industries and countries. Investigators identified more than 2,300 Iron Man templates impersonating trusted organizations, including healthcare providers, banks, retailers and government agencies.
5. Microsoft said the presence of an organization in these templates does not indicate its systems were compromised.
6. Microsoft and Health-ISAC seized and redirected domains supporting the three services under an order from the U.S. District Court for the Southern District of Florida.
7. Microsoft has disabled more than 20,000 accounts connected to YAM Store and continues to remove infrastructure hosted on its services and block more than 100,000 domains used for impersonation and fraud.
   

Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit

Next Up in Cybersecurity

• Health system executives are under pressure to move fast on AI. They are implementing tools for ambient documentation, agentic AI,…

• Health systems are generating more patient data than at any point in their history. Bedside monitors, ambulatory devices and home…

• Gaithersburg, Md.-based Adventist HealthCare plans to implement Epic as its enterprisewide EHR platform, with a launch expected in 2028. The…