Loading story…
Researchers reported that IcedID (also known as BokBot) continued to evolve from a banking trojan into a multi-stage malware platform widely used to establish initial access for ransomware intrusions. Across observed campaigns, phishing emails delivered password-protected ZIP archives, malicious Word or Excel documents, or zipped JavaScript files that launched HTA scripts and DLL loaders through tools such as rundll32, regsvr32, and mshta.exe. Analysts documented several loader techniques, including disguised DLLs saved with .jpg extensions, registry-stored configuration data derived from victim-specific bot IDs, and even PNG steganography used to hide encrypted shellcode. Later reporting also described PhotoLoader and GzipLoader variants, including a newer GzipLoader build that added dynamic API resolution and XOR-based stacked-string encryption while dropping earlier SSL-pinning behavior, changes that risked breaking older pattern-based detections.
Incident responders and threat researchers linked IcedID infections to financially motivated intrusion clusters that rapidly escalated to MAZE and later EGREGOR ransomware. Mandiant said UNC2198 repeatedly leveraged access originating from the MOUSEISLAND → PHOTOLOADER → ICEDID chain, then deployed tooling including SYSTEMBC, WINDARC, Cobalt Strike BEACON, METERPRETER, KOADIC, and PowerShell EMPIRE for discovery, lateral movement, and privilege escalation, including observed abuse of CVE-2020-0787. In multiple cases, attackers used BloodHound, moved laterally over WinRM and RDP, exfiltrated data with RCLONE, and encrypted victim environments within days. Defenders published YARA rules, unpacking workflows using Qiling, registry- and network-based hunting methods, and configuration extractors to recover domains, campaign IDs, and other indicators from packed IcedID samples.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
OpenAnalysis reported that Proofpoint researchers observed a forked ICEDID variant in February 2023. The fork lacked webinject capability and was used by a small number of threat actors.
Threatray said the earliest sample of the new IcedID GZipLoader variant in its telemetry was dated February 9, 2022, providing the first explicit sample anchor for the updated loader.
Threatray reported that a new IcedID GZipLoader variant began appearing in malware feeds at the beginning of February 2022. The updated loader kept prior functionality while adding anti-analysis changes and removing SSL pinning.
VMware based a hunting and unpacking workflow on IcedID samples seen during April and May 2021, reporting that a YARA rule built around opaque predicate patterns returned many packed IcedID samples with limited false positives.
Deutsche Telekom reported that by 2021 it had observed ransomware deployment following IcedID infections and assessed that more ransomware operators were using IcedID operators' service.
A January 2021 reverse-engineering write-up described ICEID variants that hid encrypted shellcode in PNG files and noted a newer loader variant had changed from RSRC-stored RC4-encrypted code to aplib-compressed modules.
OpenAnalysis, citing Proofpoint, reported that a lite ICEDID variant was observed as a follow-on payload in November Emotet infections. This variant delivered a bot with minimal functionality and did not exfiltrate host data during loader check-in.
Mandiant observed UNC2198 move from deploying MAZE to deploying EGREGOR in engagements during October and November 2020. The shift aligned with broader late-2020 changes in ransomware affiliate activity.
Mandiant created the UNC2414 cluster in October 2020 and attributed three intrusions to it before later merging it into UNC2198.
Mandiant created the UNC2374 cluster in October 2020 after observing BEACON, WINDARC, and SYSTEMBC in an incident at a Managed Defense customer.
Between July and December 2020, Mandiant observed an ICEDID phishing infection chain using MOUSEISLAND and PHOTOLOADER stages. The activity was attributed to UNC2420, which overlaps with TA551/Shathak.
Mandiant observed UNC2198 using access derived from ICEDID infections to deploy MAZE ransomware during July 2020, tying ICEDID initial access directly to ransomware monetization.
Mandiant created the UNC2198 cluster based on a June 2020 intrusion involving ICEDID, BEACON, SYSTEMBC, and WINDARC. In that incident, the actor compromised 32 systems in 26 hours without deploying ransomware.
By late 2020, Mandiant observed a subset of groups that had deployed MAZE ransomware shifting to EGREGOR. The company linked this transition to access obtained through ICEDID infections.
VMware noted that IcedID regained attention in 2019 for using steganography to hide payloads, reflecting an evolution in its delivery and concealment techniques.
Multiple references state that IcedID, also known as BokBot, was first discovered or documented in 2017 as a banking trojan targeting financial information.
VMware published analysis of a common IcedID delivery sequence in which phishing emails with password-protected ZIP archives led to malicious Office documents, a first-stage DLL, and a second-stage DLL plus encrypted payload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
research.openanalysis.net
Open sourcethreatray.com
Open sourceforensicitguy.github.io
Open sourceblogs.vmware.com
Open sourceblogs.vmware.com
Open sourcetelekom.com
Open sourcefireeye.com
Open sourcetccontre.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Investigators tied **IcedID** (also known as **Bokbot**) command-and-control infrastructure to ransomware intrusions in which the malware served as an initial access foothold later used by **Sodinokibi/REvil** operators. In one documented compromise, a malspam-delivered XLSM macro launched IcedID through `WMIC` and `regsvr32`, after which attackers established persistence, deployed **Cobalt Strike**, moved laterally across the Windows domain, escalated to Domain Administrator, and dumped credentials from `LSASS`. The intrusion also involved Exchange server pivoting, SMB and PowerShell-based lateral movement, Active Directory discovery with techniques consistent with **BloodHound**, and additional enumeration using **AdFind** and `ping`. Before encrypting systems, the attackers used **Rclone** disguised as `svchost.exe` to exfiltrate data for double extortion, then pushed REvil ransomware from a domain controller with **BITSAdmin** and executed it with the `-smode` option to reboot hosts into Safe Mode with Networking, helping disable security and management tools; all domain-joined systems were encrypted in about 4.5 hours. Building on indicators from that case, researchers used passive DNS and infrastructure-pattern analysis to identify a broader IcedID cluster characterized by recurring domain registration and hosting behavior, including Porkbun registrations, later migration to Cloudflare name servers, and shared hosting across IPs such as `206.189.10.247`, `161.35.109.168`, `143.198.25.214`, and `83.97.20.176`, ultimately mapping **58 IP addresses** and **323 domains** believed to support IcedID operations.
Aug 15, 2026