Threat Actor: IcedID (BokBot) Syndicate
IcedID (BokBot) Syndicate is classified as an advanced Organized Cybercrime Syndicate originating primarily from Russia / Ukraine (Maksim Rudometov & Mikhail Tsarev). Driven by operational objectives spanning banking credential theft, network domain compromise & ransomware delivery bridge, this threat entity has maintained an active footprint from 2017 - 2024 (Operation Endgame Disruption). In enterprise telemetry and malware repository classification, IcedID (BokBot) Syndicate has been corroborated across 1 distinct malware families with over 118 validated sample hashes.
Operational Threat Profile & Targeting
| Known Aliases | BokBot Gang, TA551 Affiliates, Lunar Spider |
|---|---|
| Targeted Sectors | Commercial Banking, Healthcare Networks, Enterprise Active Directory Environments |
| Primary Motivations | Banking Credential Theft, Network Domain Compromise & Ransomware Delivery Bridge |
| Dominant Payload Categories | Banking Trojan |
| MITRE ATT&CK Reference | https://attack.mitre.org/software/S0483/ ↗ |
Primary Observed MITRE ATT&CK Tradecraft
The following offensive techniques have been empirically verified across implants and campaign tooling weaponized by IcedID (BokBot) Syndicate:
Exploited Vulnerabilities (CVEs)
Telemetry confirms IcedID (BokBot) Syndicate has actively weaponized the following Common Vulnerabilities and Exposures in enterprise intrusions:
- CVE-2021-40444 — Technical Dossier & Exploitation Analysis (NVD ↗)
- CVE-2022-30190 — Technical Dossier & Exploitation Analysis (NVD ↗)
Attributed Catalog Malware Families (1 Families)
The following malware implants in the SystemHelpDesk catalog have been verified in operational campaigns attributed to IcedID (BokBot) Syndicate:
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| icedid | Banking Trojan | 118 | IcedID (widely tracked across the intelligence community as BokBot) is a sophisticated modular banking trojan and initial access loader first identified in Sept... |
SOC Hardening & Defensive Containment
Defending enterprise perimeters against campaigns staged by IcedID (BokBot) Syndicate requires defense-in-depth posture enforcement:
- Egress Filtering & C2 Interception: Enforce strict egress inspection and block communication to unclassified external IP blocks, fast-flux proxy relays, and dynamic DNS providers.
- Credential Isolation & Privileged Access Management: Enforce FIDO2 hardware MFA across all administrative and VPN entry points to prevent session token hijacking and password reuse.
- Attack Surface Reduction & Patch Velocity: Prioritize remediation of public-facing edge network appliances (VPN concentrators, web servers, file transfer appliances).