Excerpt
Mapping a Vast and Currently Active IcedID Network
BokBot (also known as IcedID) started life as a banking trojan using man-in-the-browser attacks to steal credentials from online banking sessions and initiate fraudulent transactions. Over time, the operator(s) of BokBot have also developed its use as a delivery mechanism for other malware, in particular ransomware.
In the past BokBot was itself primarily distributed via the Emotet botnet. Since the takedown of Emotet earlier this year we have been tracking BokBot to see how the actors might react to and seek to exploit the situation for person…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Team Cymru on team-cymru.com.
More from Team Cymru5
- Bablosoft; Lowering the Barrier of Entry for Malicious ActorsTeam Cymru · Published 25 May 2022
- Taking Down EmotetTeam Cymru · Published 27 Jan 2021
- Webinject Panel Administration: A Vantage Point into Multiple Threat Actor CampaignsTeam Cymru · Published 3 Nov 2021
- MoqHao Part 1: Identifying Phishing InfrastructureTeam Cymru · Published 10 Jan 2021
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
