Loading threat actor…
Iron Man is a financially motivated cybercrime operation and enabling component of a Chinese-language phishing and fraud marketplace. It operates within a broader ecosystem that also includes YAM Store and CoGUI, supporting large-scale malicious messaging against consumers, healthcare organizations, financial institutions, and other businesses. The ecosystem has targeted people and organizations in Japan and globally. Chinese-language use does not establish the operators' country of origin. Associated fraud campaigns impersonate trusted organizations and use urgent claims about undeliverable packages, unpaid tolls, bank account problems, and overdue taxes to induce recipients to disclose personal information or make payments. The broader ecosystem supports credential phishing and financial fraud through fraudulent websites and online identities. Since January 2026, Iron Man, YAM Store, and CoGUI collectively enabled more than one billion malicious messages targeting over 75,000 organizations across more than 150 countries, generating tens of millions of dollars for their operators. On October 14, 2026, Microsoft and Health-ISAC announced coordinated disruption efforts against the three components. These efforts included civil litigation and the seizure and redirection of domains supporting their fraud operations.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.