Loading story…
Researchers and security organizations reported that IcedID campaigns used phishing emails with invoice-themed lures, compromised business email accounts, and malicious Microsoft Office attachments to infect victims. One campaign sent password-protected ZIP files containing Word documents with heavily obfuscated macros, while another relied on Excel xls and xlsm files using Excel 4.0 macros. In both cases, victims were prompted to enable macros, allowing the documents to retrieve second-stage malware from compromised or attacker-controlled infrastructure.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Between January 1 and March 31, 2021, Uptycs observed more than 15,000 HTTP requests tied to over 4,000 similar malicious documents in an IcedID-focused campaign. It reported that 93% of the malicious Office files in the cluster were Excel .xls or .xlsm spreadsheets delivered via email.
In July 2020, researchers observed an IcedID phishing campaign in which attackers used compromised business email accounts to send invoice-themed lures to existing customers. The campaign used password-protected ZIP files and malicious Word documents with macros to improve delivery and evade detection.
The Center for Internet Security published a security primer on IcedID, providing background on the malware family.
Uptycs reported that second-stage payloads in the broader campaign were disguised with fake extensions such as .dat, .jpg, and .gif, and included both IcedID and Qakbot. The report also assessed that IcedID was filling the gap left by Emotet's disruption and moving toward a malware-as-a-service model.
Uptycs analyzed malicious Excel documents, including a sample named "Claim_331903057_03292021.xlsm," that used Excel 4.0 macros and anti-analysis tricks to download DLL payloads disguised as .dat files. The payloads were executed with rundll32, after which the IcedID loader collected victim system information and sent it to command-and-control servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 39 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IcedID operators continued to adapt email-borne delivery chains by abusing hijacked conversation threads, compromised Microsoft Exchange accounts, and password-protected archives to make phishing messages appear legitimate. Across multiple campaigns, victims received PDFs, Word documents, or links to cloud-hosted payloads on Google Firebase or Google Cloud Storage, which led to ZIP archives containing ISO images, malicious LNK files, DLL loaders, or signed executables. Researchers tied parts of this activity to **TA551/Shathak** and reported targeting of organizations in the energy, healthcare, legal, and pharmaceutical sectors, with unpatched public Exchange servers and **ProxyShell** cited as a likely initial access path in some cases.
Aug 15, 2026
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026
Two English-language malicious spam campaigns distributed **IcedID** and, in some cases, **QBot** through ZIP attachments and ZIP download links that led victims to booby-trapped Excel files. The documents used **Excel 4.0 macros** to fetch malware with `URLDownloadToFile` and launch it through native Windows tools including **`rundll32`**, **WMI**, and **`regsvr32`**, helping the activity blend into normal system behavior. One campaign, dubbed **DotDat**, dynamically generated `.dat` payload URLs using Excel's `NOW()` function, while another relied on compromised websites hosting ZIP archives and disguised the next-stage payload behind a URL resembling a GIF file named **`summer.gif`**. Researchers also observed changes in IcedID, including a move from an x86 downloader to **x86-64**, removal of fake C2 addresses from configuration data, and replacement of shellcode hidden in PNG images with a standard **PE** payload delivered in a PNG-based format; detections showed notable IcedID activity in **China, India, Italy, the United States, and Germany**, while QBot detections were strongest in **China, India, the United States, Russia, and France**.
Aug 14, 2026