Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com


A Chinese-run phishing network has been linked to one billion phishing emails targeting 75,000 organizations, according to a report published on October 14, 2026.

The operation centers on Iron Man System, a paid phishing platform that lets criminals deploy fake websites and collect sensitive information without building their own tools.

The report lists those headline figures but does not explain their measurement period or counting method. Its detailed findings document 2,360 phishing templates covering 130 countries and areas.

These numbers describe the network’s reported reach and available tools, not confirmed breaches at every targeted organization.

Researchers from Resecurity identified and mapped the operation after buying a license and running the software in an isolated lab.

Their technical investigation into Iron Man describes a phishing kit rather than malware installed on victims’ devices. The team also entered communities managed by Chinese threat actors to investigate its developers and associates.

Chinese Phishing Network Linked to 1 Billion Messages

Iron Man System uses a Go backend and arrives as a container image, allowing buyers to run the package on their own servers.

Its Chinese-English control panel manages fake pages, brand settings, and license status. Researchers tested version 6.3.1, which displayed a subscription countdown and configured payment-related lures.

This commercial model lowers the skill needed to run phishing campaigns. Earlier reporting on Chinese language phishing services explains how ready-made templates and shared panels help criminals target several countries at once.

The “Iron Man System” admin panel (Source - Resecurity)
The “Iron Man System” admin panel (Source – Resecurity)

That wider trend provides context, but does not establish that separate services share Iron Man’s operators. The template library impersonated couriers, banks, tax agencies, retailers, telecom providers, and public bodies.

DHL had the largest individual template count, with 37, followed by DPD with 24 and Apple with 23. Delivery-related brands formed the largest category, reflecting the appeal of familiar parcel notices as phishing bait.

Comparable tactics appeared in the Panda Shop smishing kit, which used fake delivery and banking pages to collect financial information. Iron Man’s confirmed scope is distinct: its library included 551 lure-type tags, with entries updated as recently as October 1, 2026.

Exposed Builds Reveal Shared Infrastructure

Researchers found a publicly accessible Gitea server holding the kit’s code and container registry. It exposed 911 published image versions and eight registered accounts. Recent releases showed continued development, while matching project names tied the registry directly to the tested package rather than an unrelated mirror.

Build settings revealed S3-compatible storage and a MariaDB database configured on internal addresses. Static credentials appeared across historical builds, although Resecurity withheld their values.

Code analysis also linked product catalogs and uploaded images to captured records containing selected goods and payment-card fields.

The “Iron Man System” PhaaS platform (Source - Resecurity)
The “Iron Man System” PhaaS platform (Source – Resecurity)

The reusable design resembles the business approach described in the Darcula phishing service report, where subscribers receive branded templates and ongoing updates. However, the Iron Man findings do not establish that it uses Darcula’s messaging channels or shares its developers.

The lab panel checked its local license status roughly every 20 seconds, triggering server-side contact with the vendor’s authorization host.

This dependency offers defenders a central disruption point: disabling the licensing service could affect many deployments together instead of requiring separate action against each fake website.

Resecurity said Microsoft led the wider operation and its Digital Crimes Unit helped disrupt developers and infrastructure. Still, recent builds indicated ongoing activity. Attribution remains limited: the report links infrastructure and accounts, but confirms no operator’s real-world identity.

Indicators of compromise (IoCs):-

Type Indicator Role or qualification
Domain api2[.]peaceman[.]cc Confirmed licensing backend
Domain ipapi2[.]peaceman[.]cc Auxiliary API
Domain bin2[.]peaceman[.]cc Auxiliary API
Domain log2[.]peaceloving[.]xyz Telemetry and logging
Domain ossapi[.]haoeryu[.]top Object storage
Domain docker[.]aidchildren[.]cc Gitea build registry
Domain docker[.]loveboy[.]xyz Alternate registry hostname
Domain install[.]loveboy[.]xyz Deployment console
Domain api2[.]haoyutai[.]cc Retired configuration value
IP address 104[.]26[.]8[.]8 Observed CDN fronting address
IP address 172[.]67[.]149[.]149 Observed logging CDN address
IP address 194[.]233[.]80[.]219 Research lab; not attacker infrastructure
Account email aidchildren[@]mail[.]com Registry account: admin
Account email bsn[@]qq[.]com Registry account: bsn
Account email sgkj7856[@]gmail[.]com Registry account: sg6688
Account email 1253261414[@]qq[.]com Registry account: Po
Account email fackyouhaozi[@]qq[.]com Registry account: fackyouhaozi
Account email kubile[@]gmail[.]com Registry account: kubile
Account email j6745g[@]protonmail[.]me Registry account: jerry
Account email wfd4as567[@]gmail[.]com Registry account: wfd4as567

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Chinese Phishing Network Linked to 1 Billion Messages Targeting 75,000 Organizations appeared first on Cyber Security News.