Iron Man & CoGUI PhaaS Ecosystem: Chinese-Language Phishing Kit Disruption — OTX Pulse Analysis & Enterprise Detection Pack

---
title: Suspicious Phishing Kit Lure Domain Resolution - Iron Man / CoGUI Infrastructure
id: 8f3a1c2e-9b4d-4e7a-a1c5-2d6f8e0b3a91
status: experimental
description: Detects DNS resolution of known Iron Man System, CoGUI, CoAceV, and CoFish_Ws phishing kit infrastructure identified in OTX pulses (2026-10-15), including licensing backend hostnames.
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
product: windows
level: high
detection:
    selection_domain:
        QueryName|contains:
            - 'lygyaou.com'
            - 'kenandy.shop'
            - 'new-app-haixing.com'
            - 'farradae.com'
            - 'ylhgkj.com'
            - 'loveboy.xyz'
            - 'aidchildren.cc'
            - 'haoeryu.top'
            - 'haoyutai.cc'
            - 'peaceman.cc'
            - 'protonmail.me'
    condition: selection_domain
falsepositives:
    - 'None expected - these are dedicated phishing kit domains'
references:
    - https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus
    - https://www.resecurity.com/blog/article/iron-man-yamstore-powering-a-global-phishing-as-a-service-ecosystem
tags:
    - attack.t1566.002
    - attack.t1071.001
date: 2026/10/15
---
title: Proxy Access to PhaaS Credential Harvesting URL Patterns
description: Detects HTTP requests matching Iron Man / CoGUI kit URL structures - brand-impersonation paths and randomized token paths spoofing Japanese municipal and payment brands.
author: Security Arsenal Threat Intelligence
logsource:
    category: proxy
level: medium
id: 2b7d4e1f-5c8a-4f2b-9d3e-6a0c1f7b8e24
status: experimental
detection:
    selection_uri:
        c-uri|contains:
            - '/paidy/'
            - '/ubmisionsjp'
            - '/ubmissionsjp'
            - '.kumamoto-city.jp'
    filter_legit:
        cs-host|endswith:
            - 'paidy.com'
            - 'kumamoto-city.jp'
    condition: selection_uri and not filter_legit
falsepositives:
    - 'Legitimate Paidy or municipal traffic if filter list is incomplete - extend with verified brand domains'
references:
    - https://www.proofpoint.com/us/blog/threat-insight/disruption-targets-major-chinese-language-phishing-kits-japanese-focus
tags:
    - attack.t1566.002
    - attack.t1656
date: 2026/10/15
---
title: Browser Credential Entry Followed by Connection to Newly Observed Disposable TLD
description: Detects browser process network connections to high-risk disposable TLDs (.shop, .xyz, .top, .cc) commonly abused by Iron Man and CoGUI phishing kit deployments, correlated with page titles suggesting login or payment forms.
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
product: windows
level: medium
id: 5e9c2a8d-1f6b-4d3a-8c7e-0b2d4f6a9e15
status: experimental
detection:
    selection_image:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    selection_tld:
        DestinationHostname|endswith:
            - '.shop'
            - '.xyz'
            - '.top'
            - '.cc'
    filter_known:
        DestinationHostname|contains:
            - 'your-corporate-vendor.com'
    condition: selection_image and selection_tld and not filter_known
falsepositives:
    - 'Legitimate small vendors using low-cost TLDs - tune with an allowlist of business-approved domains'
references:
    - https://www.resecurity.com/blog/article/iron-man-yamstore-powering-a-global-phishing-as-a-service-ecosystem
tags:
    - attack.t1566
    - attack.t1071.001
date: 2026/10/15

// Iron Man / CoGUI PhaaS Infrastructure Hunt - Microsoft Sentinel
// Hunts network connections and DNS queries to kit and licensing backend IOCs (OTX 2026-10-15)
let PhaaSIoCs = dynamic([
    "lygyaou.com", "kenandy.shop", "new-app-haixing.com", "farradae.com",
    "ylhgkj.com", "loveboy.xyz", "protonmail.me", "aidchildren.cc",
    "haoeryu.top", "haoyutai.cc", "peaceman.cc"
]);
let Lookback = 30d;
let NetworkHits = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any (PhaaSIoCs)
    | project Timestamp, DeviceName, InitiatingProcessAccountName,
              InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType;
let DnsHits = DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | extend RemoteUrl = tostring(RemoteUrl)
    | where RemoteUrl endswith ".shop" or RemoteUrl endswith ".xyz"
       or RemoteUrl endswith ".top" or RemoteUrl endswith ".cc"
    | where RemoteUrl has_any ("paidy", "kumamoto", "api2", "bin2", "docker")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP;
union NetworkHits, DnsHits
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp),
            Connections=count(), Processes=make_set(InitiatingProcessFileName)
    by DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| sort by Connections desc

# Iron Man / CoGUI PhaaS IOC Hunt Script - Security Arsenal
# Checks DNS cache, browser history artifacts, and proxy-relevant network state for kit IOCs
# Run elevated on endpoints or via your EDR remote shell / Intune remediation

$IoCs = @(
    'lygyaou.com','kenandy.shop','new-app-haixing.com','farradae.com',
    'ylhgkj.com','loveboy.xyz','protonmail.me','aidchildren.cc',
    'haoeryu.top','haoyutai.cc','peaceman.cc','paidy.farradae.com'
)

$findings = @()

Write-Host "[*] Checking DNS client cache for PhaaS kit domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($ioc in $IoCs) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$ioc*" }
    if ($hits) {
        foreach ($h in $hits) {
            $findings += [PSCustomObject]@{
                Source = 'DNSCache'; IOC = $ioc; Detail = "$($h.Entry) -> $($h.Data)"; Severity = 'HIGH'
            }
        }
    }
}

Write-Host "[*] Checking active and recent TCP connections..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)' }
foreach ($c in $conns) {
    try {
        $rdns = ([System.Net.Dns]::GetHostEntry($c.RemoteAddress)).HostName
        foreach ($ioc in $IoCs) {
            if ($rdns -like "*$ioc*") {
                $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
                $findings += [PSCustomObject]@{
                    Source = 'NetConnection'; IOC = $ioc
                    Detail = "$proc (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort) [$rdns]"
                    Severity = 'CRITICAL'
                }
            }
        }
    } catch { }
}

Write-Host "[*] Sweeping Chrome/Edge history for lure URL patterns..." -ForegroundColor Cyan
$historyPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
$patterns = @('paidy','ubmisionsjp','ubmissionsjp','kumamoto-city','.shop/','.xyz/','.top/')
foreach ($hp in $historyPaths) {
    if (Test-Path $hp) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().Guid + ".db")
        Copy-Item $hp $tmp -Force -ErrorAction SilentlyContinue
        # Requires SQLite; if unavailable, note artifact for offline EDR query instead
        $findings += [PSCustomObject]@{
            Source = 'BrowserArtifact'; IOC = 'n/a'
            Detail = "History DB copied to $tmp for offline SQLite analysis against patterns: $($patterns -join ', ')"
            Severity = 'INFO'
        }
    }
}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($findings.Count -eq 0) {
    Write-Host "[+] No PhaaS IOC artifacts found on this host." -ForegroundColor Green
} else {
    $findings | Sort-Object Severity | Format-Table -AutoSize
    $findings | Export-Csv -Path ".\phaas_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) finding(s) exported to CSV. Escalate CRITICAL/HIGH to IR immediately." -ForegroundColor Red
}