Iron Man System, a commercial phishing-as-a-service platform supplying criminals with ready-made websites impersonating banks, couriers, tax agencies, traffic authorities, and other trusted organizations worldwide.
Researchers purchased a license through human intelligence operations and deployed the kit inside an isolated laboratory.
Packet captures and configuration analysis connected the working deployment to vendor-controlled infrastructure, providing evidence beyond promotional claims.
Resecurity’s HUNTER team also infiltrated communities managed by Chinese threat actors to investigate the developers and their associates.
Iron Man uses a Go backend and ships as a containerized, self-hosted package. Its bilingual Chinese-English administration panel lets buyers manage separate phishing frontends associated with impersonated brands.
The observed laboratory deployment ran version 6.3.1 and displayed a subscription countdown.
Microsoft tracks the developers behind Iron Man, CoGUI and Haozi collectively as Storm-2990. Its technical investigation describes WebSocket-based collection and Telegram notifications that let operators follow victims entering credentials, payment details and verification codes.
Operators can manually control subsequent screens, turning static impersonation pages into interactive fraud sessions.
Microsoft also documented geofencing, fake CAPTCHA gates and IP filtering across the associated kits. These controls restrict researcher access and complicate automated inspection.
Importantly, a brand’s appearance in a phishing template does not establish that the impersonated organization was compromised.
The geographic totals differ between reports: Resecurity counted 130 countries and areas, while Microsoft described broader coverage.
These separately reported inventories should not be treated as identical datasets or evidence of confirmed compromises in every location.
Resecurity confirmed api2[.]peaceman[.]cc as the primary authorization backend through network observations and recovered configuration.
Resecurity investigation identified, 2,360 phishing templates across 130 countries and regions, along with a shared licensing backend and an actively maintained distribution pipeline.
Additional endpoints supported auxiliary API traffic and telemetry. An older configuration referenced api2[.]haoyutai[.]cc, but researchers identified that address as inactive rather than a current operational indicator.
A publicly accessible Gitea instance, reachable through docker[.]aidchildren[.]cc and docker[.]loveboy[.]xyz, exposed 911 historical container-image versions and eight registered accounts.
Recent publications indicated continued development. Configuration artifacts also identified ossapi[.]haoeryu[.]top as an S3-compatible storage endpoint and revealed static credentials reused across historical builds; those secrets were withheld.
Binary analysis linked the platform to a goods-catalog and image-upload subsystem.
Victim-reporting queries associated selected products with payment-card fields, connecting shopping-themed lures to the kit’s financial-data collection workflow.
Because deployments regularly contact centralized authorization infrastructure, coordinated action against licensing, distribution and storage services could affect multiple criminal customers simultaneously, rather than removing individual phishing pages.
Microsoft’s October 14 disclosures connect Iron Man to YAM Store, tracked as Storm-3119, which supplies fraudulently obtained cloud accounts and infrastructure.
The broader ecosystem collectively enabled more than one billion malicious messages targeting over 75,000 organizations since January 2026; those figures should not be attributed exclusively to Iron Man.
Microsoft and Health-ISAC obtained a Florida federal court order to seize and redirect supporting domains.
Defenders should correlate the published infrastructure with DNS, proxy and identity telemetry, investigate suspicious cloud applications, and prioritize phishing-resistant authentication.
Microsoft also reported deactivating more than 20,000 YAM Store-linked accounts and blocking over 100,000 impersonation and fraud domains.
Microsoft additionally recommends network protection, tighter privileged access and verification of urgent payment or account messages through independently obtained contact channels.
| Type | Value | Notes |
|---|---|---|
| Domain | api2[.]peaceman[.]cc | License/authorization backend |
| Domain | ipapi2[.]peaceman[.]cc | Auxiliary API |
| Domain | bin2[.]peaceman[.]cc | Auxiliary API |
| Domain | log2[.]peaceloving[.]xyz | Telemetry/logging |
| Domain | ossapi[.]haoeryu[.]top | Object storage (CDN-fronted) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…