The only thing worse than a powerful piece of malware, is a powerful piece of malware which has evolved into something more dangerous, just like IcedID.
IcedID first emerged onto the digital landscape in 2017, when it was classed as a banking trojan and started targeting financial institutions in the US, Canada, and UK. IcedID’s main objective, in 2017, was to steal sensitive data such as credit card details. However, the very best threat actors are those that regularly update and repurpose their malware to evade detection and become more effective. And that’s exactly what they have done with IcedID, turning it from a banking trojan into something much more complex.
What is IcedID’s New Strategy?
IcedID has evolved, but what exactly has it evolved in to? Well, the objective of retrieving sensitive financial details appears to have been removed. However, IcedID is now concentrating its efforts on delivering further malicious payloads to compromised systems. Essentially, it’s opening your IT systems up to a whole new world of pain.
Using the BackConnect module, IcedID communicates with a command-and-control server which allows the transfer of commands and files to the infected system. Originally, this attack was easy to detect as IcedID used TCP port 8080 to transfer data and communications. However, the threat actors behind this new wave of attacks, quickly changed their approach and began to compromise TCP port 443, which is much harder for security software to detect as it usually only handles encrypted data.
At least 20 command-and-control servers have been detected since April 2023, indicating that the threat actors behind IcedID are keen to not only disguise their tracks, but also keep security experts guessing. IcedID appears to compromise its victims by carrying out a sustained campaign of data harvesting and using them as a connection point in spamming campaigns, which are used to spread IcedID even further.
Staying Safe from IcedID
The exact point at which this current IcedID campaign infects a host is currently unknown, but earlier variants of IcedID from 2023 used malicious email attachments. Therefore, it’s important for all your PC users to remain vigilant against the threat of infected emails arriving in their inbox. In particular, make sure they look out for the following:
- Check email address and domain: always make sure that the sender’s email is genuine, without misspellings or unusual domain extensions that resemble well-known entities e.g. G00glemail. And when it comes to unfamiliar addresses, especially those that claim to be official sources, scrutinize them closely.
- Content and language: pay attention to language inconsistencies and an urgent tone, especially one which urges you to take immediate action. Unexpected attachments and links, particularly from unknown senders, should always be checked by an IT professional as the risk of malware in these instances is high.
- Requests for personal information: it’s vital that you treat requests for sensitive data, such as passwords or financial details, with suspicion. Legitimate organizations typically won’t ask for this information via email. Verify such requests directly through secure channels such as face-to-face or via telephone before responding.
For more ways to secure and optimize your business technology, contact your local IT professionals.
Read More