Loading story…
Investigators tied IcedID (also known as Bokbot) command-and-control infrastructure to ransomware intrusions in which the malware served as an initial access foothold later used by Sodinokibi/REvil operators. In one documented compromise, a malspam-delivered XLSM macro launched IcedID through WMIC and regsvr32, after which attackers established persistence, deployed Cobalt Strike, moved laterally across the Windows domain, escalated to Domain Administrator, and dumped credentials from LSASS. The intrusion also involved Exchange server pivoting, SMB and PowerShell-based lateral movement, Active Directory discovery with techniques consistent with BloodHound, and additional enumeration using AdFind and ping.
Before encrypting systems, the attackers used Rclone disguised as svchost.exe to exfiltrate data for double extortion, then pushed REvil ransomware from a domain controller with BITSAdmin and executed it with the -smode option to reboot hosts into Safe Mode with Networking, helping disable security and management tools; all domain-joined systems were encrypted in about 4.5 hours. Building on indicators from that case, researchers used passive DNS and infrastructure-pattern analysis to identify a broader IcedID cluster characterized by recurring domain registration and hosting behavior, including Porkbun registrations, later migration to Cloudflare name servers, and shared hosting across IPs such as 206.189.10.247, 161.35.109.168, 143.198.25.214, and 83.97.20.176, ultimately mapping 58 IP addresses and 323 domains believed to support IcedID operations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
After filtering for false positives, Silent Push compiled a dataset of 58 IP addresses, 323 domain names, and 402 domain-to-IP combinations assessed as very likely belonging to IcedID infrastructure. Some of these domains had not previously been publicly associated with IcedID.
Using passive DNS pivots from the DFIR Report indicators, Silent Push identified additional clusters of domains and IPs linked to IcedID, including infrastructure on 206.189.10.247, 161.35.109.168, 143.198.25.214, and 83.97.20.176. The analysis highlighted recurring registration, DNS, and hosting patterns across the clusters.
The DFIR Report published an analysis of the intrusion, documenting how IcedID enabled follow-on access that culminated in Sodinokibi/REvil ransomware deployment. The report included IcedID command-and-control indicators such as cikawemoret34[.]space and nomovee[.]website.
IBM X-Force discovered IcedID in 2017. The malware initially operated as a banking trojan before later being used as an initial access tool for ransomware intrusions.
The attackers created a Group Policy Object named "new" to disable Windows Defender, staged the ransomware on a domain controller, and distributed it with BITSAdmin. The Sodinokibi/REvil payload was executed with the "-smode" option to reboot systems into Safe Mode with Networking and encrypt domain-joined systems.
Before ransomware deployment, the attackers used Rclone disguised as svchost.exe to collect and exfiltrate data from network shares. This supported a double-extortion phase prior to encryption.
The operators pivoted first to an Exchange server and then to other systems using SMB, PowerShell beacons, remote services, and RDP. They dumped LSASS credentials and performed discovery with AdFind, ping, and LDAP/BloodHound-style techniques.
Within about 1.5 hours of initial access, the attackers downloaded Cobalt Strike beacons from cloudmetric.online (45.86.163.78) and smalleststores.com (195.189.99.74). These beacons were then used throughout the intrusion with process injection and follow-on operations.
After execution, IcedID beaconed to 161.35.109.168:443 throughout the intrusion and created a scheduled task for persistence. The DFIR Report also identified nomovee[.]website and cikawemoret34[.]space as IcedID command-and-control servers used in the case.
A March intrusion began with malicious spam carrying an XLSM document that required macros and ultimately executed IcedID disguised as a GIF payload. The infection chain used WMIC, regsvr32, and rundll32 to launch the malware.
Multiple suspected IcedID domains switched from registrar parking to Cloudflare name servers and then to shared hosting IPs, with staggered timing suggesting activation shortly before campaigns. Some domains also briefly pointed to 83.97.20.176 or used Russia's Server Space name servers before later migration.
Domains later associated with IcedID infrastructure were registered in February or March, mostly through Porkbun, with at least one through NameSilo. They were initially parked at Porkbun before later DNS and hosting changes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **IcedID** (also known as **BokBot**) continued to evolve from a banking trojan into a multi-stage malware platform widely used to establish initial access for ransomware intrusions. Across observed campaigns, phishing emails delivered password-protected ZIP archives, malicious Word or Excel documents, or zipped JavaScript files that launched HTA scripts and DLL loaders through tools such as `rundll32`, `regsvr32`, and `mshta.exe`. Analysts documented several loader techniques, including disguised DLLs saved with `.jpg` extensions, registry-stored configuration data derived from victim-specific bot IDs, and even PNG steganography used to hide encrypted shellcode. Later reporting also described PhotoLoader and GzipLoader variants, including a newer GzipLoader build that added dynamic API resolution and XOR-based stacked-string encryption while dropping earlier SSL-pinning behavior, changes that risked breaking older pattern-based detections. Incident responders and threat researchers linked IcedID infections to financially motivated intrusion clusters that rapidly escalated to **MAZE** and later **EGREGOR** ransomware. Mandiant said UNC2198 repeatedly leveraged access originating from the MOUSEISLAND → PHOTOLOADER → ICEDID chain, then deployed tooling including **SYSTEMBC**, **WINDARC**, **Cobalt Strike BEACON**, **METERPRETER**, **KOADIC**, and **PowerShell EMPIRE** for discovery, lateral movement, and privilege escalation, including observed abuse of `CVE-2020-0787`. In multiple cases, attackers used **BloodHound**, moved laterally over WinRM and RDP, exfiltrated data with **RCLONE**, and encrypted victim environments within days. Defenders published YARA rules, unpacking workflows using **Qiling**, registry- and network-based hunting methods, and configuration extractors to recover domains, campaign IDs, and other indicators from packed IcedID samples.
Aug 15, 2026
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Researchers and incident responders detailed multiple **IcedID** intrusion chains that used phishing, hijacked email threads, contact-form abuse, and compromised mail infrastructure to deliver the malware through deceptive attachments and loaders. Campaigns sent password-protected ZIPs, ISO and LNK chains, macro-enabled Office files, and JavaScript or HTA downloaders, while also abusing legitimate services such as Google Sites and trusted email conversations. Several delivery paths relied on **masquerading** techniques, including DLLs disguised as `.jpg` files, fake GZip wrappers, and steganographic payloads hidden in PNG images, with follow-on execution through tools and binaries such as `mshta.exe`, `rundll32`, `regsvr32.exe`, WScript, and PowerShell. Once executed, IcedID unpacked encrypted configurations and payloads, injected into legitimate processes, established persistence with scheduled tasks, and contacted command-and-control infrastructure including URI paths such as `/news/`. Technical analyses showed the malware using custom encryption, custom PE formats, RC4-decrypted PNG loaders, anti-analysis checks, and browser-hook or secondary payload components, while incident reporting tied infections to rapid post-compromise activity including **Cobalt Strike** deployment, credential theft from LSASS, Active Directory reconnaissance, SMB and RDP lateral movement, and use as an access broker for ransomware or espionage operations, including attacks against Ukrainian government entities.
Aug 15, 2026