Loading story…
Threat researchers reported that Emotet, IcedID, and QBot were used as initial access malware to quickly deliver Cobalt Strike on compromised Windows systems, sharply reducing the time defenders had to respond before hands-on-keyboard activity began. In observed intrusions, reconnaissance started within 6 to 8 minutes of infection, while Cobalt Strike was deployed in as little as under an hour to roughly two hours later. The activity was commonly initiated through targeted phishing emails carrying malicious Office documents and macros, with follow-on use of PowerShell, scheduled tasks, Run keys, or services to establish persistence and pull additional payloads.
Pull IOCs and campaign context straight into your stack.
11 events from the most recent confirmed update back to the earliest known activity.
On 2022-07-07, SANS ISC documented an Emotet malspam infection in a lab Windows host where a macro-enabled Excel attachment downloaded Emotet DLLs and led to delivery of a Cobalt Strike payload. The report published hashes, file paths, download URLs, and network indicators for both Emotet command-and-control traffic and the follow-on Cobalt Strike activity.
Cisco reported that Emotet showed increased activity from 2022 onward after its November 2021 re-emergence.
In December 2021, Emotet changed its infection chain to directly install Cobalt Strike beacons instead of first deploying TrickBot or Qbot/QakBot, according to BleepingComputer citing Cofense and other researchers.
Cisco said Emotet re-emerged in November 2021 following its January 2021 disruption.
Cisco reported that a combined law enforcement effort involving Interpol and Eurojust disrupted Emotet in January 2021.
Cybereason observed a broader mid-2021 "stolen images evidence" phishing campaign in which emails impersonated copyright complaints and led victims to download JavaScript that fetched IcedID.
Cisco observed an increase in IcedID banking trojan infections in late February and throughout March 2018, many delivered through spear-phishing Word documents that led to Ursnif/Dreambot and then IcedID.
Cisco said security researchers first reported IcedID in November 2017 and that, at the time of discovery, Emotet was distributing it.
Cisco stated that Emotet was first observed in 2014 as a banking trojan and modular malware family.
Cofense reported a limited number of Emotet infections that installed Cobalt Strike, attempted to contact lartmana[.]com, and then removed the executable shortly afterward.
Cybereason analyzed an intrusion attributed in part to Conti affiliates in which a targeted phishing email delivered IcedID, followed by reconnaissance, attempted privilege escalation, code injection, and Cobalt Strike deployment within roughly two hours.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 81 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourceisc.sans.edu
Open sourceblogs.cisco.com
Open sourcebleepingcomputer.com
Open sourceblog.talosintelligence.com
Open sourcethedfirreport.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Multiple incident reports describe **Qakbot** infections delivered through phishing emails that linked to ZIP archives containing malicious Excel files, often using Excel 4.0 macros to fetch DLL payloads. On compromised Windows systems, the malware executed downloaded DLLs with `regsvr32.exe`, contacted multiple command-and-control servers, and in some cases used distribution tags such as **`obama166`** and **`aa`**. Researchers observed Qakbot storing artifacts on disk, changing persistence behavior compared with earlier variants, and in broader campaigns stealing Outlook credentials, adding Windows Defender exclusions, and using internal email threads to spread further inside organizations. Follow-on activity showed operators deploying **Cobalt Strike** and VNC-based remote access, including **DarkVNC** traffic over TCP 443 and VNC beaconing detected after the initial compromise. In one analyzed case, Cobalt Strike and VNC activity appeared about 17 hours after infection, indicating a second-stage intrusion after Qakbot established foothold. Additional reporting ties these intrusions to hands-on-keyboard actions such as reconnaissance, lateral movement over SMB admin shares, service-based persistence, and preparation for ransomware deployment, while one campaign also reportedly abused **PrintNightmare** (`CVE-2021-34527`) for SYSTEM-level execution and may have leveraged **ProxyLogon** and **ProxyShell** to help distribute malicious emails in enterprise environments.
Aug 15, 2026
Malicious Excel spreadsheets distributed in ZIP archives were used to infect Windows systems with malware assessed as likely **SystemBC**, using a GlobalSign-themed lure to convince users to enable macros. Once executed, the macro downloaded a Windows payload, wrote it to a newly created path under `C:\`, and established persistence through a scheduled task. The infected host then communicated with `109.234.39.169` over TCP port `4001`, consistent with the observed SystemBC-related activity. Follow-on intrusion activity included HTTP requests that returned obfuscated code used to launch **Cobalt Strike**, followed by HTTPS and DNS beaconing tied to `fastonent[.]com` and `192.169.6.8`. The observed post-compromise behavior differed by environment: in an Active Directory lab, the infection progressed to Cobalt Strike activity, while a stand-alone host showed only the suspected SystemBC communications, indicating the malware chain may selectively deploy additional tooling on domain-connected systems.
Aug 15, 2026