Loading story…
Two English-language malicious spam campaigns distributed IcedID and, in some cases, QBot through ZIP attachments and ZIP download links that led victims to booby-trapped Excel files. The documents used Excel 4.0 macros to fetch malware with URLDownloadToFile and launch it through native Windows tools including rundll32, WMI, and regsvr32, helping the activity blend into normal system behavior.
One campaign, dubbed DotDat, dynamically generated .dat payload URLs using Excel's NOW() function, while another relied on compromised websites hosting ZIP archives and disguised the next-stage payload behind a URL resembling a GIF file named summer.gif. Researchers also observed changes in IcedID, including a move from an x86 downloader to x86-64, removal of fake C2 addresses from configuration data, and replacement of shellcode hidden in PNG images with a standard PE payload delivered in a PNG-based format; detections showed notable IcedID activity in China, India, Italy, the United States, and Germany, while QBot detections were strongest in China, India, the United States, Russia, and France.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
By April 2021, the malicious activity associated with the second spam campaign had faded away.
The second spam campaign, which used links to hacked websites hosting malicious ZIP archives and disguised payload URLs as a GIF file named summer.gif, reached its peak on March 17, 2021.
For March 2021, detection data showed IcedID activity concentrated in China, India, Italy, the United States, and Germany, while QBot activity was strongest in China, India, the United States, Russia, and France.
Researchers observed two new English-language spam campaigns in mid-March 2021 distributing ZIP attachments or ZIP download links that ultimately delivered banking malware, primarily IcedID and in some cases QBot.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and security organizations reported that **IcedID** campaigns used phishing emails with invoice-themed lures, compromised business email accounts, and malicious Microsoft Office attachments to infect victims. One campaign sent password-protected ZIP files containing Word documents with heavily obfuscated macros, while another relied on Excel `xls` and `xlsm` files using **Excel 4.0 macros**. In both cases, victims were prompted to enable macros, allowing the documents to retrieve second-stage malware from compromised or attacker-controlled infrastructure.
Aug 15, 2026
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026
IcedID operators continued to adapt email-borne delivery chains by abusing hijacked conversation threads, compromised Microsoft Exchange accounts, and password-protected archives to make phishing messages appear legitimate. Across multiple campaigns, victims received PDFs, Word documents, or links to cloud-hosted payloads on Google Firebase or Google Cloud Storage, which led to ZIP archives containing ISO images, malicious LNK files, DLL loaders, or signed executables. Researchers tied parts of this activity to **TA551/Shathak** and reported targeting of organizations in the energy, healthcare, legal, and pharmaceutical sectors, with unpatched public Exchange servers and **ProxyShell** cited as a likely initial access path in some cases.
Aug 15, 2026