Two new variants of the infamous IcedID malware have been spotted, however both are lacking certain distinctive features, making security experts curious as to their purpose.
Cybersecurity researchers from Proofpoint revealed (opens in new tab) since February, they have been tracking two versions of IcedID, one called “Lite”, and the other called “Forked”.
Both come without the usual online banking fraud features, instead supposedly working more as a dropper for more elaborate campaigns.
Stealth malware tactics
Proofpoint says that it’s seen at least three different hacking groups using these two versions across seven campaigns since late last year. Apparently, these groups have been using IcedID as a stepping stone toward ransomware infections.
Why exactly threat actors decided to strip IcedID of its unique features remains unclear, but some reports have suggested that removing “unneeded” functions makes it stealthier and leaner, helping cybercriminals stay hidden for longer.
The way IcedID is delivered to victims also differs. In some cases, the attackers would distribute phishing emails with Microsoft OneNote attachments. In other cases, they’d use Emotet.
The researchers noted that the existence of two new variants does not mean the original malware is no longer being used.
As recently as March 10, 2023, some threat actors still choose to deploy what Proofpoint calls the “Standard” variant. The researchers believe most threat actors will still opt for the standard variant, even though Lite and Forked might gain some popularity this year.
IcedID is an old, modular banking trojan, usually used to deploy stage-two malware. So far, cybersecurity researchers have seen it used in countless campaigns, mostly used by access brokers to obtain, and later sell, access to high-value networks and endpoints.
One such group was TA551, a threat actor with no concrete ties to any nation-state. The group was seen selling access obtained via IcedID last April.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba