IcedID

Description

IcedID is a botnet that has been around since 2017 and grew from a banking trojan into one of the most popular loaders for serious intrusions. It steals personal data, credentials, and banking information through web injects and form grabbing, and it downloads and executes other payloads such as Cobalt Strike and ransomware. Cyberattackers deliver it through phishing, malvertising, and loader chains, and its modular design has kept it central to organized crime ecosystems for years.

Stats

First seen: January 2022
Last seen: October 2026

Also known as

IcedIdIcedid

MITRE ATT&CK techniques

31 techniques across 8 tactics.

TA0001 Initial Access

T1189Drive-by Compromise
T1566Phishing
- T1566.001Spearphishing Attachment

TA0002 Execution

T1047Windows Management Instrumentation
T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
T1106Native API
T1204User Execution
- T1204.002Malicious File

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.009Embedded Payloads
- T1027.013Encrypted/Encoded File
- T1027.003Steganography
- T1027.002Software Packing
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
- T1055.012Process Hollowing
- T1055.004Asynchronous Procedure Call
T1218System Binary Proxy Execution
- T1218.007Msiexec
- T1218.011Rundll32
T1497Virtualization/Sandbox Evasion

TA0007 Discovery

T1016System Network Configuration Discovery
T1069Permission Groups Discovery
T1082System Information Discovery
T1087Account Discovery
- T1087.002Domain Account
T1135Network Share Discovery
T1482Domain Trust Discovery
T1518Software Discovery
- T1518.001Security Software Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0009 Collection

T1185Browser Session Hijacking

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.002Asymmetric Cryptography

TA0010 Exfiltration

T1048Exfiltration Over Alternative Protocol
- T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Associated groups

Associated campaigns

C0037Water Curupira Pikabot Distribution

Alert name variants

Alert Name	Engine
ByteCode-MSIL.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Document-Excel.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Document-HTML.Dropper.IcedID	ATP Sandbox Adv. Heuristics
Document-HTML.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Document-Office.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Document-PDF.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Gen:Variant.IcedID.11	AV
Gen:Variant.IcedId.112612	AV
Gen:Variant.IcedId.122234	AV
Gen:Variant.IcedId.309728	AV
Gen:Variant.IcedID.5	AV
Gen:Variant.IcedId.766959	AV
Gen:Variant.IcedId.875133	AV
Gen:Variant.Patched.Icedid.1	AV
GT:JS.IcedId.1.2E6755BF	AV
GT:JS.IcedId.1.A69A6A8F	AV
JS:Trojan.IcedID.13	AV
Script-JS.Downloader.IcedId	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Script-Macro.Downloader.IcedId	ATP Sandbox Adv. Heuristics
Script-Macro.Downloader.IcedID	ATP Sandbox Adv. Heuristics
Script-Macro.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Script-WScript.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Shortcut.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Trojan.Spy.IcedId.A	AV
Trojan.Spy.IcedId.D	AV
Trojan.Spy.IcedId.EJQS	AV
Trojan.Spy.IcedId.F	AV
Win32.Trojan.IcedID	ATP Sandbox Adv. Heuristics
Win64.Trojan.IcedID	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Win.Trojan.IcedID download attempt	IPS-SWG
MALWARE-CNC Win.Trojan.IcedID outbound connection attempt	IPS-SWG
MALWARE-CNC Win.Trojan.IcedID Powershell Stager outbound connection	IPS-SWG
MALWARE-OTHER Win.Trojan.IcedID Loader DLL download attempt	IPS-SWG
MALWARE-OTHER Win.Trojan.IcedID Powershell Stager download attempt	IPS-SWG
MALWARE-OTHER Win.Trojan.IcedID variant binary download attempt	IPS-SWG