INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Resecurity identifies and dismantles Iron Man System phishing operation

| 2026-10-27 16:12 MEDIUM HIGH PHISHING & SOCIAL ENGINEERING
JSON
Executive Summary
AI-generated
Resecurity identified and mapped infrastructure supporting a commercial Phishing-as-a-Service operation marketed as 'Iron Man System.' The kit is sold to criminal buyers as a self-hosted package deploying pre-built lure pages impersonating postal services, banks, government agencies, and other trusted entities. Through infiltration of Chinese threat actor communities and acquisition of a license, Resecurity traced the back-end infrastructure and found 2,360 phishing templates targeting 130 countries. The operation features a self-hosted build registry with 911 published versions, bilingual Chinese-English interface, and subscription-based licensing tied to vendor-controlled authorization servers.
Technical Mitigations AI-generated
• User Training (ATT&CK mitigation for Impersonation): Train users to be aware of impersonation tricks and how to counter them, for example confirming incoming requests through an independent platform like a phone call or in- • Audit (ATT&CK mitigation for Phishing): Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. • Account Use Policies (ATT&CK mitigation for Social Engineering): Adds verification for helpdesk resets, approvals, and app consents commonly targeted by impersonation.
Technical Observables 41 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 41 IoCs Create Free Account
domains 27 files 1 urls 11 sha256 1 md5 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
FIVE_EYES FIVE_EYES NORTH_AMERICA NORTH_AMERICA manufacturingmanufacturing legallegal financefinance healthhealth governmentgovernment
Incident Timeline
‎2026/10/27
Threat actors used fake business bid invitations and protected documents to target Microsoft 365 accounts, leveraging phishing kits with common roots linked to the Iron Man System.
organisation Microsoft
Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals.
By combining Microsoft 365 session theft with remote-access tool deployment, CSuite can turn a phishing incident into broader account compromise, fraud, and persistent access to business systems.
This leads to a counterfeit Microsoft login page where entered credentials are harvested and transmitted to attacker-controlled servers.
infrastructure Microsoft 365
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access.
By combining Microsoft 365 session theft with remote-access tool deployment, CSuite can turn a phishing incident into broader account compromise, fraud, and persistent access to business systems.
CSuite Phishing Leads to Both Account and Endpoint Access CSuite attack chain exposed by ANY.RUN researchers CSuite starts with familiar business lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365.
organisation Resecurity
Through infiltration of Chinese threat actor communities and acquisition of a license, Resecurity traced the back-end infrastructure and found 2,360 phishing templates targeting 130 countries.
Microsoft noted that it shared information with U.S. and international law enforcement partners and worked with cybersecurity firm Resecurity to infiltrate the sites.
victims 75,000 organizations
The kit captured approximately 17.4GB of telemetry data targeting 75,000 organizations through an estimated 1 billion phishing emails.
Microsoft on Wednesday announced legal action disrupting three powerful phishing platforms used by Chinese cybercriminals to send hundreds of millions of malicious messages impersonating over 75,000 organizations worldwide.
organisation Protected Documents
Locked and Loaded: Phishing through Fake Bids and Protected Documents.
organisation kenandy[.]shop
hxxps://www[.]proofpoint[.]com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus Indicators of compromise: lygyaou[.]com hxxps://kenandy[.]shop/paidy/ubmisionsjp/ hxxps://lygyaou[.]com/9AioLNhtdi[.]kumamoto-city[.]jp hxxps://new-app-haixing[.]com/1DWSd1DeDf[.]kumamoto-city[.]jp hxxps://paidy[.]farradae[.]com/paidy/ubmissionsjp hxxps://ylhgkj[.]com/BCu…
organisation Iron Man & YamStore
Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem.
organisation Iron Man System
Resecurity identified and mapped infrastructure supporting a commercial Phishing-as-a-Service operation marketed as 'Iron Man System.'
data_breach 17.4 GB
The kit captured approximately 17.4GB of telemetry data targeting 75,000 organizations through an estimated 1 billion phishing emails.
organisation Microsoft 365 Sessions
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access.
organisation Remote Access
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access.
organisation CSuite
ANY.RUN researchers traced a US-focused CSuite phishing campaign across 351 sandbox analyses, with 51% of submissions coming from the United States.
organisation Endpoint Access CSuite
CSuite Phishing Leads to Both Account and Endpoint Access CSuite attack chain exposed by ANY.RUN researchers CSuite starts with familiar business lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365.
organisation Adobe, DocuSign, Zoom
CSuite Phishing Leads to Both Account and Endpoint Access CSuite attack chain exposed by ANY.RUN researchers CSuite starts with familiar business lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365.
organisation Adobe
In one ANY.RUN sandbox session, an Adobe-themed lure delivered a BAT file that elevated privileges and installed ScreenConnect, showing how quickly a phishing page can turn into remote endpoint access.
organisation BAT
In one ANY.RUN sandbox session, an Adobe-themed lure delivered a BAT file that elevated privileges and installed ScreenConnect, showing how quickly a phishing page can turn into remote endpoint access.
organisation Project Bid Invitation'
The attack begins with an email titled 'Project Bid Invitation' containing a password-protected PDF attachment that evades automated security scanning.
organisation PDF
The attack begins with an email titled 'Project Bid Invitation' containing a password-protected PDF attachment that evades automated security scanning.
organisation OneDrive
Once opened, the PDF displays a fake OneDrive button redirecting victims to a fraudulent shared document drive.
organisation Health-ISAC
The ecosystem enablers YAM Store and Iron Man were also targeted through a civil lawsuit and domain seizures, conducted in collaboration between Microsoft, Health-ISAC, and multiple security partners.
organisation Digital Crimes Unit
Working with Microsoft's Digital Crimes Unit and industry partners, the cybercriminal infrastructure was mapped and disrupted.
organisation Business-Critical Sectors ANY.RUN sandbox
Strengthen Incident Response CSuite Activity Is Concentrated in the US and Business-Critical Sectors ANY.RUN sandbox telemetry shows a clear US concentration in CSuite activity, with 51% of related submissions coming from the United States .
organisation healthcare cybersecurity organization Health-ISAC
The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man.
organisation YAM Store
The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man.
infrastructure 17,000 unique domains
The threat actors demonstrated sophisticated capabilities, utilizing approximately 17,000 unique domains with frequent rotation and evasion techniques.
infrastructure 100,000 domains
Microsoft said it is still removing infrastructure hosted on its services and is blocking more than 100,000 domains used for impersonation.
data_breach 365 credentials
The sites could be used to steal Microsoft 365 credentials that could then be sold for money on YAM Store.
organisation Google
YAM Store is an initial access broker marketplace that “sells infrastructure using compromised or fraudulently obtained environments in providers like Microsoft and Google,” Microsoft researchers explained.
organisation Cybercriminals
Cybercriminals bought internet domains that real companies had allowed to expire, rebuilding websites to look like legitimate platforms.
organisation ANY.RUN’s Tier 1
ANY.RUN’s Tier 1 report with AI summaries and recommendations for faster handoff Structured investigation reports can reduce that preparation work.
Tactical Metrics
Metrics
infrastructure
17,000
Unique Domains
The threat actors demonstrated sophisticated capabilities, utilizing approximately 17,000 unique domains with frequent rotation and evasion techniques.
Metrics
data_breach
17
Gb
The kit captured approximately 17.4GB of telemetry data targeting 75,000 organizations through an estimated 1 billion phishing emails.
Metrics
victims
75,000
Organizations
The kit captured approximately 17.4GB of telemetry data targeting 75,000 organizations through an estimated 1 billion phishing emails.
Microsoft on Wednesday announced legal action disrupting three powerful phishing platforms used by Chinese cybercriminals to send hundreds of millions of malicious messages impersonating over 75,000 organizations worldwide.
Metrics
infrastructure
100,000
Domains
Microsoft said it is still removing infrastructure hosted on its services and is blocking more than 100,000 domains used for impersonation.
Metrics
infrastructure
‎Microsoft 365
Affected Product
The sites could be used to steal Microsoft 365 credentials that could then be sold for money on YAM Store.
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools for Remote Access.
By combining Microsoft 365 session theft with remote-access tool deployment, CSuite can turn a phishing incident into broader account compromise, fraud, and persistent access to business systems.
CSuite Phishing Leads to Both Account and Endpoint Access CSuite attack chain exposed by ANY.RUN researchers CSuite starts with familiar business lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365.
Victims can be pushed into credential-harvesting or device-code phishing flows designed to capture Microsoft 365 access and active sessions.
Why CSuite Escalates Fast CSuite can give attackers access to both Microsoft 365 accounts and employee endpoints , creating several ways to turn one successful phish into a wider business incident.
Metrics
data_breach
365
Credentials
The sites could be used to steal Microsoft 365 credentials that could then be sold for money on YAM Store.
Metrics
victims
16,000
Organizations
The underlying threat data comes from activity contributed by 16,000+ organizations and 700,000+ security professionals , helping teams keep coverage current as infrastructure changes.
Intelligence Sources
AlienVault OTX 2026-10-27
AlienVault OTX 2026-10-15
AlienVault OTX 2026-10-14
AlienVault OTX 2026-10-14
TheRecord 2026-10-14
The Hacker News 2026-09-30