Loading story…
ICE IX emerged as an early banking Trojan built from the leaked ZeuS source code, giving cybercriminals a ready-made platform for credential theft and botnet operations. Sold on underground forums for about $1,800, the malware used HTTP-based command-and-control through a web panel and targeted online banking sessions with browser hooking, web injects, and form grabbing. Reporting tied the threat to theft involving Amazon EC2 data, while researchers warned that the ZeuS source leak would accelerate the creation of similar follow-on crimeware families.
Technical analysis showed ICE IX largely reused ZeuS tradecraft rather than introducing major new capabilities. The malware employed RC4-protected communications, fake Google traffic to blend in, Windows registry persistence, and a self-deleting dropper, while also stealing credentials from browsers, FTP and mail clients, cookies, Flash .sol files, and certificates. Researchers found support for backconnect access, SOCKS proxying, VNC, screenshot capture, and certificate deletion, but concluded that many of the product's advertised enhancements—such as tracker resistance and stronger evasion—were overstated, amounting mostly to minor code changes and repackaging of existing ZeuS functionality.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Virus Bulletin documented ICE IX as a Zeus-descended banking bot with HTTP-based C2, RC4-obfuscated communications, web injects, form grabbing, credential theft, and support for backconnect, SOCKS, VNC, and screenshots. The analysis covered versions up to 1.2.0 and detailed how the malware manipulated banking sessions and exfiltrated data.
Analysis of Ice IX samples concluded that the malware was largely a repackaged ZeuS 2.0.8.9 variant with only minor changes, such as re-enabled email credential theft and a modified configuration download method. The researcher found no substantial innovations matching the seller's advertised enhancements.
Jorge Mieres identified a command-and-control server tied to an Ice IX-based botnet, enabling analysis of the malware's implementation and claims.
Securelist said there was evidence associating Ice IX malware activity with theft of data from Amazon Elastic Compute Cloud environments.
Ice IX was advertised for sale as an improved ZeuS-derived banking Trojan, with sellers claiming features such as firewall bypass, proactive protection evasion, and tracker resistance. Pricing cited included $600 for a version with a hardcoded C2 URL and $1,800 for one without it.
Securelist reported that Ice IX had been seen in active use since the beginning of the year. The malware was described as browser-hooking crimeware built to steal banking information.
The ZeuS 2.0.8.9 source code was made public in May, creating the basis for later ZeuS-derived crimeware such as Ice IX.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
securelist.com
Open sourcesecurelist.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **ZeuS** banking Trojan emerged as a dominant crimeware kit used to steal online banking credentials, browser-submitted form data, cookies, certificates, and files, while also enabling attackers to modify web pages, redirect victims, and execute arbitrary programs on infected systems. Reports describe ZeuS as a commercially sold toolkit priced around **$3,000–$4,000**, with add-on modules for capabilities such as backconnect access, VNC control, Firefox form grabbing, and Windows Vista/7 support. Its architecture evolved across the `1.2.x`, `1.3.x`, and `1.4.x` branches to add stronger encryption, web injects, API hooking, anti-analysis protections, random file names and mutexes, and RC4-encrypted communications with command-and-control servers, while commonly injecting into processes such as `winlogon.exe` or `explorer.exe`. The malware’s ecosystem also expanded into both competition and mobile fraud. SpyEye was marketed as a cheaper rival and introduced **"ZeusKiller"** to remove or hijack existing ZeuS infections, while ZeuS itself adopted hardware-based licensing and continued adding premium criminal features. A related mobile component, **ZeuS-in-the-Mobile (ZitMo)**, was used to intercept SMS-based transaction authentication numbers by tricking banking victims into installing fake mobile security software, allowing attackers to complete fraudulent transfers after harvesting credentials on the PC. More recent reporting also tied the **KINS** Zeus variant to a malvertising campaign targeting European transit users, where victims were redirected to malware disguised as a PDF, protections such as Windows Defender were weakened via registry changes, and the payload used characteristic POST traffic and inbound connectivity to maintain control.
Aug 15, 2026
Researchers identified **Trojan-Banker.Win32.Chthonic** as a new ZeuS-family banking Trojan that evolved from the leaked ZeuS codebase and appears to borrow from **ZeusVM**, **Andromeda**, and **KINS**. The malware was observed targeting more than **150 banks** and **20 payment systems** across **15 countries**, with notable focus on institutions in the **UK, Spain, the US, Russia, Japan, and Italy**. Initial infections were linked to malicious email campaigns carrying crafted RTF files exploiting **`CVE-2014-1761`** in Microsoft Office, as well as delivery through the **Andromeda** botnet. Chthonic uses a modular architecture that extends beyond traditional banking fraud, combining **web injections**, **form grabbing**, **keylogging**, and **password theft** with **VNC-based remote access**, **SOCKS proxy** functionality, and even **webcam recording**. Its operators also employed layered obfuscation and custom loading methods, including **RC4**, **AES**, a virtual-machine-based configuration decryptor, and ZeuS-style non-PE modules mapped directly into memory, underscoring how the ZeuS lineage had matured into a flexible and stealthy criminal malware framework.
Aug 14, 2026
**ICEDID** (Bokbot), a modular banking trojan active since 2017, is delivered through phishing campaigns and can provide initial access for follow-on tools including Cobalt Strike and ransomware. Recent variants use multistage loaders and bot payloads, with lures such as ZIP archives containing ISO files and malicious LNK shortcuts that invoke `rundll32.exe`; earlier campaigns also used password-protected ZIP files carrying macro-enabled Word documents. The malware persists through scheduled tasks or Windows Registry Run keys, retrieves components dynamically, and supports credential and browser-cookie theft, host discovery, command execution, browser-traffic proxying, process injection, reverse shells, and VNC access. ICEDID-enabled intrusions have progressed rapidly to RansomExx deployment: one observed operation used ICEDID, Vatet, PyXie, and Cobalt Strike to reach ransomware execution in roughly five hours. RansomExx operators also developed a Linux ELF variant targeting VMware-related storage environments, recursively encrypting a supplied directory with AES keys protected by a hardcoded RSA-4096 public key. Defenders can more reliably identify ICEDID command-and-control infrastructure through its TLS certificate-pinning implementation—validating certificate serial numbers against public-key hashes—combined with self-signed certificate metadata and scan results; JARM and JA3S fingerprints alone are not sufficient for attribution.
Sep 9, 2026