{
  "family": "icecold_reloaded",
  "sample_count": 1500,
  "category": "rat",
  "description": "IceCold Reloaded (cataloged across security software as Backdoor:Win32/IceCold.Reloaded, Trojan.Win32.IceCold, and Backdoor.IceCold) is a classical Delphi-based Remote Access Trojan and surveillance framework derived from the early-2000s IceCold RAT family. Widely popular on early underground cybercrime forums due to its user-friendly graphical client and builder interface, IceCold Reloaded enables threat actors to compile custom trojan server stubs. Once installed on a victim Windows computer, the malware establishes persistent registry Run keys, opens TCP listening sockets, and provides remote operators with real-time screen spying, microphone audio capture, keystroke logging, password extraction from legacy browsers and email clients, and remote command execution.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/IceCold.Reloaded",
    "Trojan.Win32.IceCold",
    "Backdoor.IceCold",
    "Win32/IceCold.RAT",
    "Trojan.IceColdReloaded"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is IceCold Reloaded and how does it operate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "IceCold Reloaded is a classic Delphi Remote Access Trojan featuring a builder interface used to generate persistent surveillance stubs."
      }
    },
    {
      "@type": "Question",
      "name": "What remote surveillance capabilities does IceCold Reloaded include?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Capabilities include desktop screen capture, microphone audio recording, keystroke logging, and password extraction."
      }
    },
    {
      "@type": "Question",
      "name": "How was IceCold Reloaded propagated to victim systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It was distributed through peer-to-peer file sharing networks, IRC chat transfers, and trojanized gaming software."
      }
    },
    {
      "@type": "Question",
      "name": "Which CVE vulnerabilities have been linked to IceCold Reloaded delivery?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Campaigns delivering IceCold Reloaded have exploited shortcut and document flaws including CVE-2010-2568 and CVE-2012-0158."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against IceCold Reloaded?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint antimalware, monitor registry Run keys and network listening sockets, and restrict administrative installation privileges."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1123",
    "T1059.003",
    "T1071.001",
    "T1547.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1056.001",
      "name": "Input Capture: Keylogging",
      "tactic": "Credential Access"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Disconnect affected endpoints from local networks to terminate active remote surveillance feeds.",
    "Kill active IceCold server processes via Task Manager or administrative command line.",
    "Remove persistence entries under HKLM and HKCU Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Conduct full credential resets across all accounts accessed on the compromised workstation."
  ],
  "what_to_avoid": [
    "Do not download game trainers, keygens, or cracks from unverified file-sharing repositories.",
    "Avoid opening unverified email attachments purporting to be media players or software updates."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.IceCold",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.IceCold/"
    },
    {
      "name": "Sophos Threat Center - Troj/IceCold-A Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~IceCold-A"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "initial_access",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "IceCold RAT Frameworks"
    ],
    "variants": [
      "IceCold v1.0",
      "IceCold Reloaded v2.1",
      "IceCold Pro"
    ]
  },
  "exploited_cves": [
    "CVE-2010-2568",
    "CVE-2012-0158"
  ],
  "iocs": {
    "file_hashes": [
      "4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d",
      "9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e"
    ],
    "delivery": [
      "Peer-to-peer file sharing networks disguised as software cracks and game cheat tools",
      "Phishing emails with malicious Microsoft Office attachments exploiting CVE-2012-0158"
    ],
    "persistence": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\IceColdReloaded",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\IceColdServer"
    ]
  },
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}