Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem

Resecurity identified and mapped the infrastructure behind the 'Iron Man System,' a commercial Phishing-as-a-Service operation marketed to criminal buyers as a self-hosted phishing kit. The kit deploys pre-built lure pages impersonating various trusted entities and includes 2,360 phishing templates targeting 130 countries. The operation supports a bilingual Chinese-English interface, subscription-based licensing linked to vendor-controlled authorization servers, and a build registry with 911 versions. Through infiltration of Chinese threat actor communities and license acquisition, Resecurity traced the backend infrastructure. Collaboration with Microsoft's Digital Crimes Unit and industry partners led to the mapping and disruption of this cybercriminal infrastructure. The kit facilitated sending an estimated 1 billion phishing emails targeting 75,000 organizations and collected approximately 17.4GB of telemetry data. Several domains linked to the operation have been identified as indicators.

The phishing kit enabled widespread phishing campaigns targeting a large number of organizations globally, with an estimated 1 billion phishing emails sent and telemetry data collected from approximately 75,000 organizations. The operation's scale and sophistication facilitated credential theft and potential financial fraud across 130 countries. The disruption of the infrastructure by security researchers and law enforcement has mitigated ongoing attacks.

The infrastructure supporting the 'Iron Man System' phishing operation has been mapped and disrupted through coordinated efforts by Resecurity, Microsoft's Digital Crimes Unit, and industry partners. Organizations should block and monitor the identified malicious domains associated with this operation. No patch is applicable as this is a criminal service rather than a software vulnerability. Continued vigilance against phishing attempts and use of email filtering and anti-phishing technologies are recommended.