Loading story…
ICEDID (Bokbot), a modular banking trojan active since 2017, is delivered through phishing campaigns and can provide initial access for follow-on tools including Cobalt Strike and ransomware. Recent variants use multistage loaders and bot payloads, with lures such as ZIP archives containing ISO files and malicious LNK shortcuts that invoke rundll32.exe; earlier campaigns also used password-protected ZIP files carrying macro-enabled Word documents. The malware persists through scheduled tasks or Windows Registry Run keys, retrieves components dynamically, and supports credential and browser-cookie theft, host discovery, command execution, browser-traffic proxying, process injection, reverse shells, and VNC access.
ICEDID-enabled intrusions have progressed rapidly to RansomExx deployment: one observed operation used ICEDID, Vatet, PyXie, and Cobalt Strike to reach ransomware execution in roughly five hours. RansomExx operators also developed a Linux ELF variant targeting VMware-related storage environments, recursively encrypting a supplied directory with AES keys protected by a hardcoded RSA-4096 public key. Defenders can more reliably identify ICEDID command-and-control infrastructure through its TLS certificate-pinning implementation—validating certificate serial numbers against public-key hashes—combined with self-signed certificate metadata and scan results; JARM and JA3S fingerprints alone are not sufficient for attribution.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
As of October 14, Elastic found that 103 of 113 candidate IP addresses identified through shared self-signed certificate characteristics passed ICEDID-specific TLS certificate validation; 10 did not.
Trend Micro reported a RansomExx campaign in which a phishing email delivered IcedID, followed by Vatet, Pyxie, and Cobalt Strike, reaching ransomware deployment in about five hours. The report also documented Linux RansomExx variants targeting VMware-related storage environments.
ICEDID activity increased after Emotet was temporarily disrupted, according to Elastic Security Labs.
The threat group SecureWorks calls GOLD DUPONT became active; Trend Micro linked the group to RansomExx operations and its toolset, including Vatet, PyXie, Trickbot, and Cobalt Strike.
IBM X-Force researchers first described the ICEDID (Bokbot) banking trojan, a malware family used to steal credentials, banking data, and other personal information.
Elastic Security Labs published detection and prevention coverage for ICEDID behavior, including suspicious Rundll32 and Regsvr32 activity, and created YARA rules under the signature Windows.Trojan.ICEDID.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourceelastic.co
Open sourcetrendmicro.com
Open sourcemalwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **IcedID** (also known as **BokBot**) continued to evolve from a banking trojan into a multi-stage malware platform widely used to establish initial access for ransomware intrusions. Across observed campaigns, phishing emails delivered password-protected ZIP archives, malicious Word or Excel documents, or zipped JavaScript files that launched HTA scripts and DLL loaders through tools such as `rundll32`, `regsvr32`, and `mshta.exe`. Analysts documented several loader techniques, including disguised DLLs saved with `.jpg` extensions, registry-stored configuration data derived from victim-specific bot IDs, and even PNG steganography used to hide encrypted shellcode. Later reporting also described PhotoLoader and GzipLoader variants, including a newer GzipLoader build that added dynamic API resolution and XOR-based stacked-string encryption while dropping earlier SSL-pinning behavior, changes that risked breaking older pattern-based detections. Incident responders and threat researchers linked IcedID infections to financially motivated intrusion clusters that rapidly escalated to **MAZE** and later **EGREGOR** ransomware. Mandiant said UNC2198 repeatedly leveraged access originating from the MOUSEISLAND → PHOTOLOADER → ICEDID chain, then deployed tooling including **SYSTEMBC**, **WINDARC**, **Cobalt Strike BEACON**, **METERPRETER**, **KOADIC**, and **PowerShell EMPIRE** for discovery, lateral movement, and privilege escalation, including observed abuse of `CVE-2020-0787`. In multiple cases, attackers used **BloodHound**, moved laterally over WinRM and RDP, exfiltrated data with **RCLONE**, and encrypted victim environments within days. Defenders published YARA rules, unpacking workflows using **Qiling**, registry- and network-based hunting methods, and configuration extractors to recover domains, campaign IDs, and other indicators from packed IcedID samples.
Aug 15, 2026
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026