Loading story…
Security researchers detailed a lightweight method for identifying IcedID command-and-control infrastructure without relying on full malware reverse engineering, using a distinctive self-signed TLS certificate repeatedly found on the malware’s servers. The certificate commonly carries issuer and subject values including CN=localhost, C=AU, ST=Some-State, and O=Internet Widgits Pty Ltd, allowing defenders to search internet-wide scan data for likely matches and rapidly narrow candidate hosts tied to the banking trojan.
The infrastructure was then validated by reproducing IcedID’s certificate verification logic, in which the malware hashes the certificate public key with FNV-1a 32-bit and compares the result to the certificate serial number, sometimes after XOR with 0x384A2414. Using that process, researchers confirmed 52 IcedID servers and found the infrastructure commonly exposed ports 443, 80, and 22, frequently ran Debian and nginx, and was concentrated in Romania, the United States, and Germany; related reporting on IcedID and its loader activity underscores the malware’s continued use in credential theft and banking-focused intrusions.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Netresec analyzed an IcedID infection chain delivered through a fake Microsoft Teams download page and published network-based indicators including the C2 IP, domains, certificate fingerprints, and JA3/JA3S values. The analysis highlighted that IcedID beacons to command-and-control infrastructure at five-minute intervals and noted the malware's custom BackConnect capability for VNC, file management, and reverse shell access.
Elastic Security Labs combined Censys certificate searches, Check Point’s TLS validation logic, and JARM/JA3S fingerprinting to identify 113 candidate IPs tied to IcedID infrastructure. As of October 14, 2022, the researchers confirmed 103 of those IPs as IcedID command-and-control servers.
Team Cymru analyzed multiple IcedID campaigns from September 2022 and found that Stage 1 C2 domains, previously parked for weeks before use, began being registered only a few days before campaigns around 22 September 2022. The report also noted mid-to-late September anomalies including some reuse of domains or IPs and documented delivery chains such as password-protected ZIP, ISO, and LNK-based execution.
The IcedID banking malware family, also known as BokBot, first emerged in September 2017. It was described as banker malware with capabilities including browser hooking, credential theft, man-in-the-middle proxy setup, and a VNC module.
Check Point researchers used distinctive self-signed TLS certificate fields and IcedID's certificate-validation logic to hunt for command-and-control infrastructure. They narrowed internet-wide search results to 52 servers they assessed as part of IcedID C2 infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 98 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
netresec.com
Open sourceelastic.co
Open sourceteam-cymru.com
Open sourceresearch.checkpoint.com
Open sourceblog.group-ib.com
Open sourcebinarydefense.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026
Investigators tied **IcedID** (also known as **Bokbot**) command-and-control infrastructure to ransomware intrusions in which the malware served as an initial access foothold later used by **Sodinokibi/REvil** operators. In one documented compromise, a malspam-delivered XLSM macro launched IcedID through `WMIC` and `regsvr32`, after which attackers established persistence, deployed **Cobalt Strike**, moved laterally across the Windows domain, escalated to Domain Administrator, and dumped credentials from `LSASS`. The intrusion also involved Exchange server pivoting, SMB and PowerShell-based lateral movement, Active Directory discovery with techniques consistent with **BloodHound**, and additional enumeration using **AdFind** and `ping`. Before encrypting systems, the attackers used **Rclone** disguised as `svchost.exe` to exfiltrate data for double extortion, then pushed REvil ransomware from a domain controller with **BITSAdmin** and executed it with the `-smode` option to reboot hosts into Safe Mode with Networking, helping disable security and management tools; all domain-joined systems were encrypted in about 4.5 hours. Building on indicators from that case, researchers used passive DNS and infrastructure-pattern analysis to identify a broader IcedID cluster characterized by recurring domain registration and hosting behavior, including Porkbun registrations, later migration to Cloudflare name servers, and shared hosting across IPs such as `206.189.10.247`, `161.35.109.168`, `143.198.25.214`, and `83.97.20.176`, ultimately mapping **58 IP addresses** and **323 domains** believed to support IcedID operations.
Aug 15, 2026