IcedID Malware Shifts Focus from Banking Fraud to Ransomware Delivery

Many threat actors have been noticed using two new variants of the IcedID malware in the wild with additional minimal operation that eliminates operation relevant to on the internet banking fraud.

IcedID, also regarded as BokBot, started off as a banking trojan in 2017. It can be also able of providing additional malware, which includes ransomware.

“The nicely-recognized IcedID variation consists of an initial loader which contacts a Loader [command-and-control] server, downloads the standard DLL Loader, which then delivers the common IcedID Bot,” Proofpoint explained in a new report revealed Monday.

A person of the new versions is a Lite variant that was formerly highlighted as currently being dropped as a observe-on payload by the Emotet malware in November 2022. Also recently noticed in February 2023 is a Forked variant of IcedID.

Both these variants are intended to drop what’s named a Forked version of IcedID Bot that leaves out the web injects and backconnect performance that would normally be employed for banking fraud, the business security organization mentioned.

“It is possible a cluster of menace actors is applying modified variants to pivot the malware absent from common banking trojan and banking fraud action to concentration on payload delivery, which probable contains prioritizing ransomware shipping and delivery,” Proofpoint noted.

The February marketing campaign has been tied to a new team christened TA581, with the risk actor distributing the Forked variant utilizing weaponized Microsoft OneNote attachments. One more malware utilized by TA581 is the Bumblebee loader.

WEBINARDiscover the Concealed Dangers of Third-Party SaaS Apps

Are you mindful of the dangers affiliated with 3rd-party application access to your company’s SaaS apps? Join our webinar to find out about the forms of permissions currently being granted and how to limit risk.

RESERVE YOUR SEAT

In all, the Forked IcedID variant has been employed in seven distinctive campaigns to day, some of which have been undertaken by initial access brokers (IABs).

The use of current Emotet infections to produce the Lite variant has raised the likelihood of a prospective partnership amongst Emotet builders and IcedID operators.

“Although traditionally IcedID’s primary purpose was a banking trojan, the removing of banking functionality aligns with the total landscape change away from banking malware and an rising focus on currently being a loader for adhere to-on bacterial infections, like ransomware,” the scientists reported.

Found this write-up interesting? Observe us on Twitter  and LinkedIn to study much more special content material we article.

Some sections of this report are sourced from:
thehackernews.com