Loading story…
Researchers linked a Chile-geolocated IP address to administration of IcedID (also known as BokBot) infrastructure, tying it to the 216.73.159.0/24 netblock and to active BackConnect and Loader systems used by the malware. The IP also communicated with a Netherlands-hosted server serving two IcedID-associated domains, and its activity showed an operational pause from mid-December 2022 to late January 2023 followed by a shift from WireGuard to OpenVPN. Investigators said the node was more likely used for infrastructure management, development, or testing than for victim-facing command-and-control, and noted browsing activity to DNS, privacy, Tor, and services linked to the Conti and LockBit ecosystems.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
Team Cymru observed the Chilean IP connecting to 168.100.8.93:443 beginning on 27 January 2023 and continuing daily through the time of writing. The destination hosted two domains assessed as matching current IcedID naming conventions.
When activity resumed on 26 January 2023, access to the Chilean IP shifted from WireGuard VPN to OpenVPN. Researchers noted they had previously seen both VPN technologies used in IcedID BackConnect infrastructure management.
Team Cymru observed a gap in activity from the Chilean IP used in IcedID infrastructure management beginning on 12 December 2022. The pause aligned with timelines previously seen across IcedID Bot, Loader, and BackConnect infrastructure.
Researchers identified svoykbragudern[.]com as another IcedID-linked domain resolving to 168.100.8.93. The domain was registered on 18 November 2022.
Researchers identified neonmilkustaers[.]com as an IcedID-linked domain resolving to 168.100.8.93. The domain was registered on 9 November 2022.
The Team Cymru reference states that IcedID, also known as BokBot, began in early 2017 as a banking trojan before later evolving into a dropper associated with follow-on malware and ransomware activity.
The same 0x0d4y analysis released defender-focused content including an Elastic EQL sequence rule, a YARA rule for the x64 DLL stager, a Suricata signature keyed on the __gads cookie parameter, and a Python configuration extractor.
A 0x0d4y blog post analyzed a lightweight x64 IcedID second-stage DLL injected into svchost.exe, documenting a changed configuration decryption routine and recovering the C2 hostname podiumstrtss.com.
Team Cymru reported a newly observed IP geolocated to Chile that communicated with active IcedID BackConnect and Loader infrastructure, and assessed it was likely used for administration, development, or testing rather than victim-facing C2.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
0x0d4y.blog
Open sourceteam-cymru.com
Open sourcechuongdong.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Investigators tied **IcedID** (also known as **Bokbot**) command-and-control infrastructure to ransomware intrusions in which the malware served as an initial access foothold later used by **Sodinokibi/REvil** operators. In one documented compromise, a malspam-delivered XLSM macro launched IcedID through `WMIC` and `regsvr32`, after which attackers established persistence, deployed **Cobalt Strike**, moved laterally across the Windows domain, escalated to Domain Administrator, and dumped credentials from `LSASS`. The intrusion also involved Exchange server pivoting, SMB and PowerShell-based lateral movement, Active Directory discovery with techniques consistent with **BloodHound**, and additional enumeration using **AdFind** and `ping`. Before encrypting systems, the attackers used **Rclone** disguised as `svchost.exe` to exfiltrate data for double extortion, then pushed REvil ransomware from a domain controller with **BITSAdmin** and executed it with the `-smode` option to reboot hosts into Safe Mode with Networking, helping disable security and management tools; all domain-joined systems were encrypted in about 4.5 hours. Building on indicators from that case, researchers used passive DNS and infrastructure-pattern analysis to identify a broader IcedID cluster characterized by recurring domain registration and hosting behavior, including Porkbun registrations, later migration to Cloudflare name servers, and shared hosting across IPs such as `206.189.10.247`, `161.35.109.168`, `143.198.25.214`, and `83.97.20.176`, ultimately mapping **58 IP addresses** and **323 domains** believed to support IcedID operations.
Aug 15, 2026
Security researchers detailed a lightweight method for identifying **IcedID** command-and-control infrastructure without relying on full malware reverse engineering, using a distinctive self-signed TLS certificate repeatedly found on the malware’s servers. The certificate commonly carries issuer and subject values including `CN=localhost`, `C=AU`, `ST=Some-State`, and `O=Internet Widgits Pty Ltd`, allowing defenders to search internet-wide scan data for likely matches and rapidly narrow candidate hosts tied to the banking trojan. The infrastructure was then validated by reproducing IcedID’s certificate verification logic, in which the malware hashes the certificate public key with **FNV-1a 32-bit** and compares the result to the certificate serial number, sometimes after XOR with `0x384A2414`. Using that process, researchers confirmed **52** IcedID servers and found the infrastructure commonly exposed ports **443**, **80**, and **22**, frequently ran **Debian** and **nginx**, and was concentrated in **Romania, the United States, and Germany**; related reporting on IcedID and its loader activity underscores the malware’s continued use in credential theft and banking-focused intrusions.
Aug 15, 2026