Resecurity Maps Iron Man Phishing-as-a-Service Infrastructure and 2,360 Lures
Summary
Resecurity mapped the Iron Man System PhaaS operation using a lab deployment, packet capture, registry artifacts and binary analysis. It identified 2,360 phishing templates across 130 areas; Microsoft’s DCU facilitated disruption.
Key points
- Resecurity purchased a license and deployed the kit in an isolated lab; packet captures and build configuration corroborated the live licensing and authorization backend.
- A publicly accessible operator registry exposed 911 published build versions and eight registered accounts; recent publications indicated an actively maintained pipeline.
- The catalog contained 2,360 phishing lure packages spanning 130 countries and areas, impersonating services including courier, tax, banking, telecom and loyalty brands.
- Binary analysis linked the kit to a goods-catalog and image-upload subsystem; its submission records included goods-selection fields alongside payment-card fields.
- The infrastructure included licensing, telemetry, object storage and build-registry components. Resecurity assessed the licensing dependency as a potential centralized disruption point.
- Microsoft’s Digital Crimes Unit facilitated disruption of the ecosystem’s primary developers and infrastructure. Resecurity said no production victim systems or live buyer deployments were tested, and no operators’ real-world identities were confirmed.
Article Details
- Attack Vectors
- The commercially sold Iron Man System PhaaS kit deploys pre-built phishing pages impersonating postal and courier services, tax agencies, banks, telecoms, and other organizations.
- The kit captures data submitted by victims, including records containing card data.
- The kit is distributed as a self-hosted package and depends on vendor-operated licensing and backend infrastructure.
- The report describes the campaigns as mass-market phishing and smishing, but does not provide specific message-delivery details.
- Defensive Notes
- The report identifies the licensing backend as a centralized dependency; disabling or sinkholing it could degrade active deployments.
- Resecurity proposes a coordinated takedown of the licensing host and build registry, combined with sinkholing the storage domain, to disrupt the operation.
- Treat api2[.]haoyutai[.]cc as a retired legacy configuration value, not an active IOC.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | api2[.]peaceman[.]cc | Confirmed live license and authorization backend for the Iron Man System kit. |
| HOSTNAME | bin2[.]peaceman[.]cc | Auxiliary API endpoint observed in network traffic from the lab deployment. |
| HOSTNAME | docker[.]aidchildren[.]cc | Operator-run build registry and Gitea instance hosting the kit's published images. |
| HOSTNAME | docker[.]loveboy[.]xyz | Alternate hostname for the operator-run build registry and Gitea instance. |
| HOSTNAME | install[.]loveboy[.]xyz | Vendor-controlled deployment console used by buyers to provision kit deployments. |
| HOSTNAME | ipapi2[.]peaceman[.]cc | Auxiliary API endpoint observed in network traffic from the lab deployment. |
| HOSTNAME | log2[.]peaceloving[.]xyz | Telemetry and logging endpoint observed receiving recurring traffic from the lab deployment. |
| HOSTNAME | ossapi[.]haoeryu[.]top | Vendor-controlled object-storage endpoint referenced by the kit's shipped configuration. |
MITRE ATT&CK
Vendors
Products
GiteaSelf-hosted Gitea instance — git repositories + container registry (primary access point observed)Iron Man Systemsupporting a commercial phishing-kit-as-a-service (PhaaS) operation marketed under the name “Iron Man System.” The kit is sold to criminal buyers as a self-hosted package that deploys pre-built lure pages
Tools
Industries
Banking2,360 distinct phishing lure packages impersonating postal/courier, tax, banking, telecom and loyalty-programme brands across 130 countries/areas, updated as recently as 1 October 2026.Governmentbanks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries.Healthcareaccess to Iron Man’s infrastructure and found 2,360 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries.Postal and courier servicesto criminal buyers as a self-hosted package that deploys pre-built lure pages impersonating postal and courier services, toll and traffic-fine authorities, tax agencies, banks, telecoms and loyalty programmes, thenTransportationand found 2,360 phishing templates impersonating banks, retailers, healthcare providers, transportation authorities, police departments and government agencies across 130 countries.