What is IcedID Malware?

IcedID Malware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Banking credentials; loader to ransomware operations

Source Attribution

Origin: MITRE
Source: CISA advisory AA23-038A · MITRE ATT&CK
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: CISA advisory AA23-038A · MITRE ATT&CK · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2017-09 discovered IcedID first observed
2023-02 updated CISA advisory AA23-038A published

Quick Answer

IcedID initial access via phishing; it performs browser manipulation, credential theft and hands-off loading of Cobalt Strike beacons into enterprise networks.

Definition

IcedID (BokBot) is a banking trojan/loader delivering follow-on payloads (TrickBot, Cobalt Strike, ransomware) and performing banking fraud via web-injects.

Overview

IcedID (BokBot) is a banking trojan/loader delivering follow-on payloads (TrickBot, Cobalt Strike, ransomware) and performing banking fraud via web-injects.

Behavior

Web-inject banking fraud
Cobalt Strike beacon delivery
Tied to QakBot/Bazar callbacks

First Seen

2017-09

Target

Banking credentials; loader to ransomware operations

Techniques: T1566, T1185, T1219
Campaigns: n/a
Related CVEs: CVE-2023-21608

Malware Intelligence

Family: IcedID Malware

Aliases: IcedID, BokBot

Techniques: T1566, T1185, T1219

Targets: Banking credentials; loader to ransomware operations

Behavior:

Web-inject banking fraud
Cobalt Strike beacon delivery
Tied to QakBot/Bazar callbacks

References

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating IcedID Malware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about IcedID Malware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.