Iron Man Phishing-as-a-Service Kit Impersonates Banks, Couriers and Government Agencies Worldwide
Iron Man phishing-as-a-service impersonates banks and agencies; Microsoft tracks its developers as Storm-2990.
Resecurity and Microsoft describe Iron Man System, a commercial phishing-as-a-service kit that supplies self-hosted sites impersonating banks, couriers, tax agencies, and other organizations. A lab deployment of version 6.3.1 used a Go backend, and Resecurity counted 2,360 templates across 130 countries, with licensing tied to api2.peaceman.cc. Operators collect credentials, payment data, and verification codes over WebSockets and can steer sessions interactively, with Telegram notifications, geofencing, fake CAPTCHA gates, and IP filtering. Microsoft tracks the developers of Iron Man, CoGUI, and Haozi as Storm-2990 and links the wider YAM Store ecosystem, tracked as Storm-3119, to more than one billion malicious messages since January 2026, a figure not exclusive to Iron Man. Microsoft and Health-ISAC obtained a Florida federal order to seize supporting domains.
- Self-hosted Go kit version 6.3.1 includes 2,360 templates across 130 countries.
- WebSockets and Telegram alerts support live credential and payment collection.
- Microsoft tracks Iron Man, CoGUI, and Haozi developers as Storm-2990.
- License backend api2.peaceman.cc was confirmed; an older domain was inactive.
- A Florida court order authorizes seizure of supporting phishing domains.
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | api2.haoyutai.cc | PI traffic and telemetry. An older configuration referenced api2[.]haoyutai[.]cc, but researchers identified that address as inactive ra |
| domain | api2.peaceman.cc | nfirmed compromises in every location. Resecurity confirmed api2[.]peaceman[.]cc as the primary authorization backend through network ob |
| domain | bin2.peaceman.cc | backend Domain ipapi2[.]peaceman[.]cc Auxiliary API Domain bin2[.]peaceman[.]cc Auxiliary API Domain log2[.]peaceloving[.]xyz Telemetry |
| domain | docker.aidchildren.cc | or. A publicly accessible Gitea instance, reachable through docker[.]aidchildren[.]cc and docker[.]loveboy[.]xyz, exposed 911 historical cont |
| domain | docker.loveboy.xyz | a instance, reachable through docker[.]aidchildren[.]cc and docker[.]loveboy[.]xyz, exposed 911 historical container-image versions and ei |
| domain | ipapi2.peaceman.cc | n api2[.]peaceman[.]cc License/authorization backend Domain ipapi2[.]peaceman[.]cc Auxiliary API Domain bin2[.]peaceman[.]cc Auxiliary API |
Full article652 words · extracted from gbhackers.com · click to collapse
Iron Man System, a commercial phishing-as-a-service platform supplying criminals with ready-made websites impersonating banks, couriers, tax agencies, traffic authorities, and other trusted organizations worldwide.
Researchers purchased a license through human intelligence operations and deployed the kit inside an isolated laboratory.
Packet captures and configuration analysis connected the working deployment to vendor-controlled infrastructure, providing evidence beyond promotional claims.
Resecurity’s HUNTER team also infiltrated communities managed by Chinese threat actors to investigate the developers and their associates.
Iron Man uses a Go backend and ships as a containerized, self-hosted package. Its bilingual Chinese-English administration panel lets buyers manage separate phishing frontends associated with impersonated brands.
The observed laboratory deployment ran version 6.3.1 and displayed a subscription countdown.
Microsoft tracks the developers behind Iron Man, CoGUI and Haozi collectively as Storm-2990. Its technical investigation describes WebSocket-based collection and Telegram notifications that let operators follow victims entering credentials, payment details and verification codes.
Operators can manually control subsequent screens, turning static impersonation pages into interactive fraud sessions.
Microsoft also documented geofencing, fake CAPTCHA gates and IP filtering across the associated kits. These controls restrict researcher access and complicate automated inspection.
Importantly, a brand’s appearance in a phishing template does not establish that the impersonated organization was compromised.
The geographic totals differ between reports: Resecurity counted 130 countries and areas, while Microsoft described broader coverage.
These separately reported inventories should not be treated as identical datasets or evidence of confirmed compromises in every location.
Resecurity confirmed api2[.]peaceman[.]cc as the primary authorization backend through network observations and recovered configuration.
Resecurity investigation identified, 2,360 phishing templates across 130 countries and regions, along with a shared licensing backend and an actively maintained distribution pipeline.
Iron Man Phishing-as-a-Service
Additional endpoints supported auxiliary API traffic and telemetry. An older configuration referenced api2[.]haoyutai[.]cc, but researchers identified that address as inactive rather than a current operational indicator.
A publicly accessible Gitea instance, reachable through docker[.]aidchildren[.]cc and docker[.]loveboy[.]xyz, exposed 911 historical container-image versions and eight registered accounts.
Recent publications indicated continued development. Configuration artifacts also identified ossapi[.]haoeryu[.]top as an S3-compatible storage endpoint and revealed static credentials reused across historical builds; those secrets were withheld.
Binary analysis linked the platform to a goods-catalog and image-upload subsystem.
Victim-reporting queries associated selected products with payment-card fields, connecting shopping-themed lures to the kit’s financial-data collection workflow.
Because deployments regularly contact centralized authorization infrastructure, coordinated action against licensing, distribution and storage services could affect multiple criminal customers simultaneously, rather than removing individual phishing pages.
Microsoft’s October 14 disclosures connect Iron Man to YAM Store, tracked as Storm-3119, which supplies fraudulently obtained cloud accounts and infrastructure.
The broader ecosystem collectively enabled more than one billion malicious messages targeting over 75,000 organizations since January 2026; those figures should not be attributed exclusively to Iron Man.
Microsoft and Health-ISAC obtained a Florida federal court order to seize and redirect supporting domains.
Defenders should correlate the published infrastructure with DNS, proxy and identity telemetry, investigate suspicious cloud applications, and prioritize phishing-resistant authentication.
Microsoft also reported deactivating more than 20,000 YAM Store-linked accounts and blocking over 100,000 impersonation and fraud domains.
Microsoft additionally recommends network protection, tighter privileged access and verification of urgent payment or account messages through independently obtained contact channels.
IOCs
| Type | Value | Notes |
|---|---|---|
| Domain | api2[.]peaceman[.]cc | License/authorization backend |
| Domain | ipapi2[.]peaceman[.]cc | Auxiliary API |
| Domain | bin2[.]peaceman[.]cc | Auxiliary API |
| Domain | log2[.]peaceloving[.]xyz | Telemetry/logging |
| Domain | ossapi[.]haoeryu[.]top | Object storage (CDN-fronted) |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Mayura Kathirhttps://gbhackers.com/
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.