Microsoft's temporary order moves 34 names under five domains; its billion messages are not a victim count

Thirty-four names, 287 days and a billion messages

Microsoft's announcement of 14 October puts one figure first: since January, YAM Store, CoGUI and Iron Man "collectively enabled more than one billion malicious messages" aimed at more than 75,000 organisations. The court order that let Microsoft and Health-ISAC move the infrastructure rests on a much smaller list. Its two appendices list 34 internet names: 14 under one registered domain for the YAM Store storefront, and 20 under four registered domains for the CoGUI and Iron Man install, licence, build and telemetry hosts (derived: counted from the appendices of the order entered on 7 October 2026, which were read as page images).

The arithmetic that follows is derived and labelled. From 1 January to 14 October is 287 days counting both ends, so the more than 750 million messages Microsoft says were aimed at its own customers average about 2.6 million a day, or 30 a second (derived). That is the scale of a count. It is not the scale of a harm, and the record does not turn one into the other.

What the record does not establish is the list a defender needs: how many messages reached an inbox or a phone; how many people or organisations were deceived; how much money was taken from them; who runs the services; whether the three platforms are in fact offline; and how quickly replacements appear. Each gap is taken in turn below, with the figures the filings do give.

One interest to state plainly. Microsoft sells the security products its own post advertises, runs the Digital Crimes Unit that brought the case, and pleads that its cloud service and trademarks were abused, so it is plaintiff, investigator and publisher of the headline numbers. Health-ISAC, the co-plaintiff, is a non-profit. Proofpoint, Resecurity and TRM Labs sell email security, threat intelligence and blockchain tracing, and supplied evidence or support.

This briefing reads Microsoft's announcement and its Threat Intelligence post, the complaint, the temporary restraining order, the emergency motion and six sworn declarations from Microsoft's pleadings page, the statements of JC3, Proofpoint, Resecurity and TRM Labs, and the coverage in The Record, SecurityWeek, CyberScoop, BleepingComputer and The Hacker News. The court papers are scanned images, read by optical character recognition and checked by eye. Health-ISAC's page repeats Microsoft's announcement. No separate statement from Japan's National Police Agency was found, though JC3, a non-profit that works with it, published one. The court docket itself was not read. Sources were read between 19:05 and 19:35 BST on Wednesday 14 October 2026.

Why the headlines differ: 750 million, one billion and 75,000

The Record says the platforms were used to send "hundreds of millions of malicious messages impersonating over 75,000 organizations". SecurityWeek's headline says "1B+ Messages". Both work from the same Microsoft announcement, which gives two counts and says how they relate: more than one billion in all, "including more than 750 million messages geared toward Microsoft customers alone". The 750 million is a part of the billion. The Record's body sentence is right; its first sentence pairs the smaller count with the 75,000 organisations, which belong to the larger.

Six accounts of one announcement, read against Microsoft's own wording (announcement and Threat Intelligence post, 14 October 2026)

Where it appears	What it says	What Microsoft's text supports
SecurityWeek headline	"1B+ Messages"	Supported. The total for the three services since January, stated as more than one billion.
The Record, first sentence	Hundreds of millions of messages impersonating over 75,000 organizations	Mixed. The 750 million is the Microsoft-customer part and the 75,000 belongs to the billion. Microsoft says the messages were targeting the organisations, not impersonating them.
The Record, second sentence	The order was obtained with Japan's National Police Agency and Health-ISAC	The plaintiffs are Microsoft and Health-ISAC. The announcement describes the National Police Agency as providing intelligence and investigative support.
CyberScoop	"More than three-quarters" of the messages targeted Microsoft customers	Not stated by Microsoft. It gives two floors, over 750 million and over one billion, so no share follows from them.
BleepingComputer	Microsoft said the platforms "delivered over 750 million messages", many by device-code phishing	The announcement says "geared toward", not delivered. The post says device code was abused "in some cases".
Threat Intelligence post	"responsible for facilitating the sending of over one billion phishing emails and SMS messages" to over 75 thousand organizations	The primary. Email and SMS together, and the verb is facilitating the sending.

A tempting average divides 750 million by 75,000 and gets 10,000 messages per organisation. That ratio mixes a subset with the total. The matching ratio is one billion over 75,000, about 13,333 per targeted organisation (derived; a mean of two floors, with "organisation" undefined in the announcement). The gap between the two floors is 250 million, but because both are "more than", it is not the size of the non-Microsoft remainder, which is not stated.

Microsoft's own documents do not use one verb for the count, and none of them describes the counted messages as delivered, opened or clicked. Proofpoint's declaration, which counts a different vantage point, is in the table because it shows how much a count depends on whose sensor produced it.

How five documents word a message count; the verbs are the evidence

Document	Wording	What it counts
Announcement, 14 October	"enabled more than one billion malicious messages targeting over 75,000 organizations"	Messages the services made possible, aimed at organisations. Method not stated.
Threat Intelligence post, 14 October	"facilitating the sending of over one billion phishing emails and SMS messages"	Sending, email and SMS together.
Microsoft investigator's declaration, 5 October	In one 30-day sample, 1,163 tenants "generating more than 179 million phishing messages", impacting over 70,000 Microsoft customers	Messages from tenants Microsoft links to YAM Store. "Impacting" is not defined.
Complaint, dated 6 October	At its peak one alleged CoGUI operator's infrastructure was "responsible for sending over sixty-five thousand malicious phishing email messages per day" to Microsoft customers	One alleged operator's peak, per day.
Proofpoint declaration, 5 October	"regularly detect and block over 100 million email messages per month" for CoGUI and related kits	Messages stopped in Proofpoint's customers' mail, a different vantage point from Microsoft's.

Set these against the 2.6 million a day average and the series does not look smooth. The complaint's peak for one operator's deployment is 65,000 a day, so the average day in the announcement is about 40 times that (derived). The declaration's sample points the other way: 1,163 tenants, 2.3 per cent of the more than 50,000 Microsoft links to YAM Store, generated more than 179 million messages in 30 days, about six million a day and 24 per cent of the 750 million (derived). The sample counts YAM Store tenants and the 750 million counts three services, so the two cannot be nested with certainty. If all 50,000 tenants ran at the sample's rate, one 30-day month would carry about 7.7 billion messages (derived), more than the billion Microsoft gives for 287 days. So the sample is not typical of the tenants, or the tenants were not all active together, or the counts are not of the same thing. The filings do not say how the sample was chosen.

Other vantage points give other scales. Proofpoint's declaration says it regularly stops over 100 million CoGUI-family messages a month; over the same 287 days that rate would be about 940 million (derived, if it held), which sits beside Microsoft's billion but cannot be added to it, because the overlap between two vendors' customers is not stated. Proofpoint's 2025 post recorded a peak of more than 172 million CoGUI messages in the single month of January 2025, and its declaration dates the kit's first appearance in its data to November 2024. About 23 months separate that first sighting from the announcement, so Microsoft's since-January window covers about 40 per cent of the kit's observed life (derived) and the billion is not a lifetime total.

What the order is, and what it moves

The case is Microsoft Corporation and Health-ISAC, Inc. against one named individual trading as the storefront, and ten Does, number 1:26-cv-26998 in the US District Court for the Southern District of Florida. The complaint is dated 6 October 2026 and pleads the Lanham Act, the Computer Fraud and Abuse Act, the Stored Communications Act, racketeering and tortious interference. It seeks damages and a permanent injunction. This briefing does not name the individual. Everything the papers say about the defendants is an allegation: one is described as believed to live in the People's Republic of China, whereabouts unknown, and the ten Does are described by role, two as suppliers of the CoGUI and Iron Man kits and the others mainly as users.

The temporary restraining order was entered on 7 October 2026, stamped 15:20 on the court's docket. It was granted without notice to the defendants and filed under seal. It directs US registries to move the 34 names to Microsoft's registrar account, MarkMonitor "or such other registrar specified by Microsoft", within three to five business days, and lets Microsoft specify how they resolve. It tells US hosting and infrastructure providers to use "reasonable best efforts" to block traffic, disable associated computers and software, and suspend services to the defendants. It sets a bond of 25,000 dollars and orders the defendants to appear within 14 days of execution of the order to show cause why a preliminary injunction should not issue. A second order, stamped 19 minutes later, grants expedited discovery to identify the defendants. The announcement came seven days after the order (derived).

The date the order was executed is not in the papers read, so the date of the show-cause hearing is not known here, and nothing read says whether a preliminary injunction has been granted. Until one is, the instrument is a temporary order.

What the order and the announcement reach, layer by layer, from the order's appendices, the declarations and the announcement

Layer	Stated	Not stated
Storefront names	14 names under one registered domain move to Microsoft's registrar account (Appendix A).	Whether the storefront has reopened at other names.
Kit install, licence, registry and telemetry names	20 names under four registered domains (Appendix B). Microsoft's declaration says disabling the licence host would "render inoperable current versions" of Iron Man.	Whether it did. Resecurity's report of 14 October says the vendor's build registry was still publishing that week; it does not say what happened after the seizure.
Buyers' own domains	None listed. Microsoft says it is blocking more than 100,000. Proofpoint saw 3,788 distinct names in 79 days.	Where and how the 100,000 are blocked, and how many new names have appeared since.
Tenants and accounts	20,042 tenants de-authorised or deleted (declaration, 5 October). The announcement says more than 20,000 accounts. More than 50,000 tenants are "likely associated".	Why the two documents use different units. About 30,000 likely associated tenants were not on the removed list on 5 October (derived).
Sales channels	The declarations describe chat-app channels for selling and supporting Iron Man.	Any step against them. The order as read does not mention them.
People	One named defendant and ten Does. Expedited discovery granted.	Any arrest, charge or identification. None is mentioned in the papers read.
Money	TRM Labs says its intelligence was key to "locating and enabling the freeze of assets" associated with the group.	The amount, where it was held, and who holds it now.

The order calls its Appendix B names "Phishing Domains", a label for hosts that the declarations describe as control panels, installation, licensing, build and storage services, not the lure pages that victims see. Resecurity's report says the lure domains are registered by the kit's customers. That is the difference between seizing a supplier and seizing a campaign, and the order, as read, does only the first.

What the counts count

Seven figures carry the story. Each is stated by someone, counts something specific, and leaves something unsaid.

Seven headline figures, what each source says it counts, and what is not stated

Figure and who states it	What it counts, as stated	Not stated
More than one billion messages (Microsoft)	Messages the three services enabled, aimed at organisations, since January 2026.	How they were counted, how SMS was counted, and how many were delivered, opened or clicked.
More than 750 million (Microsoft)	The part "geared toward" Microsoft customers.	What a customer is, and whether blocked messages are included.
Over 75,000 organisations (Microsoft)	Organisations targeted since January.	The unit: tenant, domain or recipient. The declaration's 30-day sample alone reaches over 70,000 Microsoft customers.
Tens of millions of dollars (Microsoft, repeated by JC3)	In the English texts, money generated for operators. JC3's Japanese text says the services caused damage of that size (this briefing's translation).	The basis. The only traced figure is 1.1 million dollars for YAM Store, which Microsoft's investigator says likely represents only a portion.
More than 20,000 accounts (announcement)	Accounts connected to YAM Store that Microsoft disabled.	The declaration gives 20,042 tenants, a different unit.
More than 2,300 templates in more than 150 countries (announcement)	Iron Man's catalogue.	Microsoft's post says 2,335 and 139 countries. Resecurity counted 2,360 and 130. A declaration says 1,566 archives were retrievable and 794 entries were stale, across more than 50 countries.
Victims (Health-ISAC declaration)	At least ten members received at least 2,978 emails; 283 users were compromised.	Why those ten: apparently the members the investigation found, not a sample (inference). Each affected member's harm is an estimate of more than 5,000 dollars, the figure the complaint pleads for loss.

On money, 1.1 million dollars is a floor with a method: four controlled purchases in June and July 2026 and blockchain tracing, which Microsoft's investigator says likely represents only a portion. The complaint says over 1 million dollars as of August 2026. The earliest wallet activity in the declaration dates from 2022, so even that figure is not for the same period as the billion. The tens of millions has no method in anything read. At the 199 dollars a month a Resecurity declaration records for an Iron Man licence, ten million dollars of licence income would need about 50,000 licence-months (derived), and Iron Man had been on sale for about four and a half months before the order (derived). The record does not say how many licences were sold, and the announcement does not say whether its figure is operator income, victim loss or both. JC3's Japanese text leans to loss.

Three friendly words

Takedown. The announcement's verbs are "dismantle" and "disrupt". The instrument is a temporary order moving control of 34 names. Proofpoint says the action is "likely to impact" the kits. Resecurity's report of the same day rates resilience to single-point takedown as medium, because the licensing host is a central point but the operator "controls multiple domain families that could be rotated". Microsoft's own emergency motion says why it asked for relief aimed at the suppliers: without it, "Defendants will continue to replace individual accounts and domains".

Messages. A message count measures what a sender sent or a filter saw. It does not measure what a victim lost, and the two ratios on the record are far apart. The NCSC's worked example is a financial firm that received 1,800 emails carrying malware: 1,750 were filtered, 50 reached inboxes, 14 were clicked and one device was infected, which is one in 1,800 or 0.06 per cent (derived). Health-ISAC's declaration has 283 compromised users against at least 2,978 emails across ten members, at most 9.5 in every hundred (derived). Neither ratio carries over to a billion: one is a defended firm, the other ten members identified through an investigation, not a random sample (inference). A volume figure cannot be turned into a loss figure with either.

Three platforms. The announcement names three, but they are not three of a kind. YAM Store sells tenants, not a phishing kit. A declaration says CoGUI sales stopped earlier this year and the operators pivoted to Iron Man, first sold in June 2026. Microsoft's post lists a different trio of kits, CoGUI, a further brand and Iron Man, and treats YAM Store as the marketplace behind them. Resecurity's declaration says earlier versions of Iron Man were sold under other names, and that re-use and re-branding of one codebase has let the activity continue since at least 2021. It also records a chat channel created after an earlier one was reported and removed. A name can be seized; a codebase that has already changed names several times is harder to seize.

The business in five layers

A table can list the layers; the picture shows why the order's reach and the headline's reach are different things. The order sits on the first two layers. The messages sit on the fourth.

UK section: what the record says about the UK, and what UK guidance covers

The UK is absent from the record as a named target. Microsoft's post names Japan, the United States, Australia and India as the countries where its targeted organisations sit; the complaint and the six declarations as read do not name the UK. A third-party brand-protection vendor, PhishEye, wrote in July 2026 that it had mapped Iron Man activity in more than ten countries, and inferred UK parking-operator and parcel-courier impersonation from domain names, "not confirmed against a captured page". The record therefore neither confirms nor rules out a UK brand among the templates. Microsoft adds that a brand's presence in a template "does not indicate that its systems were compromised". For the earlier case in the same series, with arrests in London, see this site's EvilTokens briefing.

The UK pages below were fetched on 14 October 2026. Each row says what the page says and what it does not do.

UK controls and routes as read from NCSC, ICO and Report Fraud pages, with what each does not do

Control or route	What the page says	What it does not do (as read)
DMARC at reject ([NCSC email security guidance](https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing))	Aims at "making it difficult for fake emails to be sent from your organisation's domains". Organisations report moving from none to quarantine in about 6 to 8 weeks, and on to reject in about 3 months.	It governs mail claiming to be from your domain. The record describes lures sent from criminals' own tenants and re-registered domains, and by SMS. That is this briefing's reading.
Suspicious Email Reporting Service ([email](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-email): report@phishing.gov.uk; [text](https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message): 7726)	The NCSC can investigate and remove scam sites and addresses. As of July 2026: more than 58 million reported scams, and 256,000 scams removed across 454,800 URLs.	The NCSC is "unable to inform you of the outcome". Removals are 0.44 per cent of reports (derived). It is not a crime report.
[NCSC Takedown Service](https://www.ncsc.gov.uk/information/takedown-service)	Works with Netcraft to remove sites pretending to be UK Government brands, fed by spam and phishing feeds and by reports.	It covers "UK Government brands and services". A bank, retailer, courier or charity needs its own route.
[Report Fraud](https://www.reportfraud.police.uk/) (England, Wales, Northern Ireland) and Police Scotland on 101	The NCSC sends anyone who lost money or was hacked to Report Fraud or Police Scotland. The ICO calls Report Fraud the national fraud and cybercrime reporting centre.	The pages read do not describe it as a route for taking down a site.
[Cyber Essentials v3.3](https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf) (April 2026)	"authentication to cloud services must always use MFA".	It counts one-time codes by SMS as MFA, adding that "SMS is not the most secure type of MFA". Microsoft's post describes these kits capturing verification codes as victims type them, and recommends phishing-resistant MFA for privileged accounts.
[ICO personal data breach guidance](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/)	If a risk to people is likely, notify the ICO "as soon as possible, and where feasible within 72 hours"; tell people without undue delay if the risk is high. The ICO says the page is under review since the Data (Use and Access) Act came into law on 19 June 2025.	It applies to a personal data breach, such as staff credentials stolen and personal data reached. Being named in a template is not one by itself (this briefing's reading).

The NCSC's guidance for organisations (version 2.0, reviewed 13 February 2024) is blunt about training: "No training package, including phishing simulations, can teach users to spot every phishing attempt." It sets four layers: make it hard for attackers to reach users, help users spot and report, limit the effect of a click, and respond quickly. It also says to measure how many people reported a phish, not only how many clicked, and not to blame people who click. Setting up DMARC, it says, "stops phishers from spoofing your domain", which helps your own mail reach inboxes and protects your name.

None of the NCSC pages read tells a commercial brand how to find look-alike domains, how to run its own takedowns, or what to tell customers during a smishing wave. The guidance on outgoing messages comes closest: it asks organisations to think about how their genuine messages look to customers and suppliers, and suggests telling them what to look out for. The monitoring and takedown steps in the checklist below are this briefing's suggestions, not NCSC guidance. Mail Check, the NCSC's free DMARC reporting service, was retired on 31 March 2026; the NCSC recommends a commercial external attack surface management product and its Check your cyber security service instead.

What a UK organisation should do, in order

What could not be verified

• Microsoft's counting method. How the one billion, the 750 million and the 75,000 were counted is not stated in the announcement, the post or the declarations read.
• Whether the platforms are down. The execution date of the order, any preliminary injunction and the services' state after the seizure are not in the papers read. No listed name, kit or channel was visited for this briefing.
• Court docket. Only the filings on Microsoft's pleadings page were read. A CourtListener search returned nothing, and the docket was not searched elsewhere.
• OCR. The scanned filings were read by optical character recognition. The two appendices, and the figures used here from the declarations and complaint (50,000, 1,163, 179 million, 20,042, 1.1 million, 65,000, 2,978, 283, 2,360, 1,566, 794, 3,788), were also checked by eye on the page images.
• Vendor figures. Proofpoint's, Resecurity's, TRM Labs' and PhishEye's figures are their own and were not independently checked. Their reports print indicators and account details that this briefing does not reproduce.
• Translation. The reading of the JC3 Japanese text as damage is this briefing's own translation.
• Statements. No separate statement from Japan's National Police Agency or from Health-ISAC beyond a repost of Microsoft's announcement was found.
• UK pages. The NCSC's reporting pages show 2021 and 2022 publication and review dates but carry July 2026 counters. The Report Fraud page refused a plain fetch and was read in a browser; no check was bypassed.
• Time-stamped. Sources were read between 19:05 and 19:35 BST on 14 October 2026. A hearing, an unsealing or a new report could change the picture within hours.

The question that exposes the gap

If the next lure arrives from a domain registered this morning, which of your controls still works, and which of them only worked because someone had already seen the domain?

Key facts