{
  "family": "icedid",
  "sample_count": 118,
  "category": "banking_trojan",
  "description": "<h3>Executive Summary</h3>\nIcedID (also known as BokBot) is a highly sophisticated, modular Banking Trojan and Initial Access Broker (IAB) malware. Initially discovered in 2017 targeting financial information via web injection, it has evolved into a formidable initial access vector for ransomware syndicates. Its primary function today is to establish a stealthy foothold within a corporate network, steal domain credentials, and facilitate the deployment of catastrophic secondary payloads like Egregor or REvil ransomware.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nIcedID is typically distributed via high-volume malspam campaigns utilizing malicious Office documents (macros) or heavily obfuscated JavaScript files. It is also frequently dropped as a secondary payload by other prevalent loaders like Emotet or TrickBot.\n\nIts technical sophistication rivals state-sponsored tools:\n<ul>\n<li><strong>Web Injection (Man-in-the-Browser):</strong> Its legacy capability involves intercepting web traffic to inject fraudulent fields into legitimate banking portals, bypassing HTTPS and 2FA to steal credentials and initiate unauthorized wire transfers.</li>\n<li><strong>Advanced Evasion and Steganography:</strong> IcedID employs highly complex evasion techniques. It often downloads its core malicious module hidden within an innocent-looking image file (steganography) to bypass network intrusion detection systems (NIDS).</li>\n<li><strong>Lateral Movement and Ransomware Deployment:</strong> Once active, it maps the Active Directory environment, dumps credentials (via Mimikatz modules), and attempts to move laterally to the Domain Controller. Once the network is fully compromised, the \"access\" is sold to a ransomware cartel for final deployment.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nAn IcedID detection is an enterprise crisis. It is a Tier-1 threat indicating that the organization has been breached by highly capable cybercriminals. If not contained immediately, a full-scale, network-wide ransomware deployment is highly probable within days or hours.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Declare a Major Incident:</strong> Immediately engage specialized third-party Incident Response (IR) teams. Isolate the affected endpoints immediately, but do not turn them off, to preserve memory forensics.</li>\n<li><strong>Active Directory Lockdown:</strong> The immediate threat is lateral movement. Hunt for anomalous admin logins, reset krbtgt account passwords (twice), and scrutinize Domain Admin account activity.</li>\n<li><strong>Enterprise-Wide Eradication:</strong> Remediating IcedID requires a coordinated network-wide effort to identify all compromised hosts, sever all C2 connections, and rebuild affected machines from known-good baselines.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Trojan.IcedID",
    "Banking.BokBot",
    "Win32/IcedID"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is IcedID?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A modular banking trojan, observed since at least 2017, designed to steal financial information; it can also load further malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does IcedID relate to Emotet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE documents that IcedID has been downloaded by Emotet in multiple campaigns, so the two were often seen together."
      }
    },
    {
      "@type": "Question",
      "name": "Is IcedID associated with ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes; as a banking trojan and loader it has been used as an initial-access stage that can precede ransomware deployment."
      }
    },
    {
      "@type": "Question",
      "name": "What is another name for IcedID?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is also tracked as BokBot."
      }
    },
    {
      "@type": "Question",
      "name": "How does IcedID spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mainly through phishing emails and as a payload dropped by other malware such as Emotet."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations defend against IcedID?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block phishing, restrict macros, monitor for credential theft and lateral movement, and keep tested offline backups in case it leads to ransomware."
      }
    },
    {
      "@type": "Question",
      "name": "Where is the authoritative reference?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MITRE ATT&CK's IcedID entry (S0483), linked on this page."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1185",
    "T1055",
    "T1027.003",
    "T1078"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:47:42Z",
  "sources": [
    {
      "name": "MITRE ATT&CK: IcedID (S0483)",
      "url": "https://attack.mitre.org/software/S0483"
    }
  ],
  "mitre_url": "https://attack.mitre.org/software/S0483",
  "type": "Banking Trojan / Initial Access Broker",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}