Loading story…
Researchers and incident responders detailed multiple IcedID intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on masquerading techniques, including DLLs disguised as .jpg files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as mshta.exe, rundll32, regsvr32.exe, WScript, and PowerShell.
Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as /news/. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including Cobalt Strike deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs released tooling to automate unpacking and analysis of IcedID's fake GZip variant, including scripts for extracting payloads, decrypting files, rebuilding custom PE files, reading configuration, and loading the core binary. The work analyzed a sample whose decrypted configuration revealed botnet ID 0x3B7D6BA4, URI /news/, and C2 domains alishaskainz.com and villageskaier.com.
Unit 42 described an IcedID infection chain discovered in early November 2022 that delivered Bokbot and used packed stage one and stage two binaries. Researchers later recovered the malware's encrypted configurations from memory.
CERT-UA reported a campaign targeting Ukrainian government agencies with Excel files named "Mobilization Register.xls" that downloaded GzipLoader and then IcedID. CERT-UA attributed the activity with moderate confidence to the UAC-0041 cluster and assessed it was intended for cyber-espionage.
A Trend Micro report from November 2021 described attacks exploiting ProxyShell and ProxyLogon on exposed Microsoft Exchange servers to hijack internal email reply chains and spread malware-laced documents. The activity was believed to involve threat group TR.
Unit 42 cites IcedDecrypt, a public script by Jquinn147 and myrtus0x0 for decrypting IcedID configurations, as having been published in May 2021. The script became a referenced precursor for later configuration extraction work.
The DFIR Report documented a May 2021 intrusion where a malspam-delivered IcedID infection led to Cobalt Strike deployment within 35 minutes, credential theft from LSASS, and lateral movement via SMB and RDP. The actor reached at least one file server but no data exfiltration or ransomware deployment was observed.
SentinelLabs analyzed a May 2021 IcedID phishing campaign in which Word macros appeared benign while extracting reversed Base64-encoded JavaScript from document content. The chain wrote an HTA file, executed it with mshta.exe, downloaded a DLL disguised as a .jpg, and ran it with rundll32.
Microsoft described an IcedID campaign that abused legitimate website contact forms and Google-hosted pages to deliver a malicious ZIP archive containing an obfuscated JavaScript loader. The chain used WScript, PowerShell, rundll32, and also deployed Cobalt Strike for follow-on activity.
Trend Micro reported a spike in IcedID activity in March 2021, with campaigns using hijacked email threads and compressed XLSM attachments containing hidden formulas and macros. The activity continued into April, though detections decreased.
Elastic notes that IcedID grew further after the temporary disruption of Emotet in early 2021. This marks a broader shift in IcedID's prominence in the malware ecosystem.
A researcher published a manual unpacking analysis of an IcedID sample, documenting high-entropy packing, memory allocation behavior, and extraction of a compressed PE payload altered from MZ to M8Z. The process yielded an extracted file identified as dump0.bin.
A GitHub Gist published a Python 3 script to reconstruct an IcedID payload hidden in a PNG file using RC4 decryption and PE rebuilding with LIEF. The script credits @nazywam and @psrok1 and cites prior public IcedID parser research.
IBM X-Force researchers discovered the IcedID malware family in 2017. Multiple references describe it as a banking trojan later used for credential theft and as a loader for additional malware.
Unit 42 replicated the stage-two decryption routine in Python and recovered multiple C2 domains—newscommercde[.]com, spkdeutshnewsupp[.]com, germanysupportspk[.]com, and nrwmarkettoys[.]com—along with the URI path news and the same campaign ID 1139942657.
By tracing the unpacked binary to WinHttpConnect, Unit 42 decrypted the stage-one IcedID configuration and recovered the C2 domain bayernbadabum[.]com and campaign ID 1139942657. This showed how runtime memory analysis could reveal configuration data hidden from static inspection.
Intezer uncovered an ongoing IcedID campaign using hijacked email conversation threads and ZIP attachments containing an ISO with an LNK and DLL. Researchers also found clues suggesting attackers were compromising vulnerable public-facing Microsoft Exchange servers to steal credentials and send phishing emails from trusted infrastructure.
F5 reported recent TA551/Shathak phishing campaigns using COVID-19-themed Word documents with malicious macros to install IcedID. The infection chain downloaded an RC4-encrypted loader hidden inside a PNG file and established persistence with scheduled tasks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourceelastic.co
Open sourceunit42.paloaltonetworks.com
Open sourcebleepingcomputer.com
Open sourcef5.com
Open sourcekienmanowar.wordpress.com
Open sourceattack.mitre.org
Open sourcegist.github.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **IcedID** (also known as **BokBot**) continued to evolve from a banking trojan into a multi-stage malware platform widely used to establish initial access for ransomware intrusions. Across observed campaigns, phishing emails delivered password-protected ZIP archives, malicious Word or Excel documents, or zipped JavaScript files that launched HTA scripts and DLL loaders through tools such as `rundll32`, `regsvr32`, and `mshta.exe`. Analysts documented several loader techniques, including disguised DLLs saved with `.jpg` extensions, registry-stored configuration data derived from victim-specific bot IDs, and even PNG steganography used to hide encrypted shellcode. Later reporting also described PhotoLoader and GzipLoader variants, including a newer GzipLoader build that added dynamic API resolution and XOR-based stacked-string encryption while dropping earlier SSL-pinning behavior, changes that risked breaking older pattern-based detections. Incident responders and threat researchers linked IcedID infections to financially motivated intrusion clusters that rapidly escalated to **MAZE** and later **EGREGOR** ransomware. Mandiant said UNC2198 repeatedly leveraged access originating from the MOUSEISLAND → PHOTOLOADER → ICEDID chain, then deployed tooling including **SYSTEMBC**, **WINDARC**, **Cobalt Strike BEACON**, **METERPRETER**, **KOADIC**, and **PowerShell EMPIRE** for discovery, lateral movement, and privilege escalation, including observed abuse of `CVE-2020-0787`. In multiple cases, attackers used **BloodHound**, moved laterally over WinRM and RDP, exfiltrated data with **RCLONE**, and encrypted victim environments within days. Defenders published YARA rules, unpacking workflows using **Qiling**, registry- and network-based hunting methods, and configuration extractors to recover domains, campaign IDs, and other indicators from packed IcedID samples.
Aug 15, 2026
IcedID operators continued to adapt email-borne delivery chains by abusing hijacked conversation threads, compromised Microsoft Exchange accounts, and password-protected archives to make phishing messages appear legitimate. Across multiple campaigns, victims received PDFs, Word documents, or links to cloud-hosted payloads on Google Firebase or Google Cloud Storage, which led to ZIP archives containing ISO images, malicious LNK files, DLL loaders, or signed executables. Researchers tied parts of this activity to **TA551/Shathak** and reported targeting of organizations in the energy, healthcare, legal, and pharmaceutical sectors, with unpatched public Exchange servers and **ProxyShell** cited as a likely initial access path in some cases.
Aug 15, 2026
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026