Loader / botnetATT&CK S0483
IcedID
Also known as: BokBot
IcedID began as a banking trojan and was increasingly used as a loader that gave ransomware operators their first foothold. It was among the malware families targeted by Operation Endgame, which Europol described in May 2024 as the largest ever operation against botnets.
- Public attribution and associated actors
- MITRE ATT&CK lists IcedID as used by TA551 and TA578.As publicly reported:TA551TA578
- First seen
- Around 2017
- Platforms
- Windows
- MITRE ATT&CK software entries
- S0483 IcedID
Status: Targeted by Operation Endgame in May 2024, coordinated by Europol (reported).
How it spreads or gets in
- Phishing attachments and links, sometimes through hijacked email threads, and malicious advertising.
Key behaviours
- Used signed Windows binaries such as rundll32 and msiexec to run its code.
- Hid configuration data inside image files (steganography).
- Hijacked browser sessions to steal banking credentials.
ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1204.002User Execution: Malicious File
- T1218.011System Binary Proxy Execution: Rundll32
- T1055.004Process Injection: Asynchronous Procedure Call
- T1027.003Obfuscated Files or Information: Steganography
- T1185Browser Session Hijacking
- T1053.005Scheduled Task/Job: Scheduled Task
- T1482Domain Trust Discovery
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on rundll32 launching DLLs from temporary or user folders.
- Detect scheduled tasks pointing to files in user profiles.
- Flag domain trust and admin-group enumeration from workstations.
Defences that work
- Filter attachments and block macros from the internet.
- Use application control for script and binary proxy execution.
- Treat loader infections as ransomware precursors.