Skip to content

IcedID

Software · ATTACK:enterprise:S0483

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0483",
  "title": "IcedID",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0483",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--5147ef15-1cae-4707-8ea1-bee8d98b7f1d",
  "external_id": "S0483",
  "domain": "enterprise",
  "created": "2020-07-15T17:55:11.252Z",
  "modified": "2025-04-22T22:16:09.049Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "IBM IcedID November 2017",
      "url": "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"
    },
    {
      "source_name": "Juniper IcedID June 2020",
      "url": "https://blogs.juniper.net/en-us/threat-research/covid-19-and-fmla-campaigns-used-to-install-new-icedid-banking-malware"
    }
  ]
}

Explicit source assertions (34)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1497

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03351a2c-8fa5-4a1a-9ad5-a8be376a06c8

Trendmicro_IcedID

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1055.012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1094b816-3db3-40a6-9b86-6a4323d4818f

DFIR_Quantum_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1614.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cce3898-db84-438a-9a7a-5cea536e00e2

DFIR_Quantum_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20e08063-e851-4230-a59e-b378ec8676ec

DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1218.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24c80905-1afb-43fa-b1c0-e8bf2e7e87e2

Trendmicro_IcedID · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25b092ce-9293-4458-95f3-53153a0993dc

Trendmicro_IcedID

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1048.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3057f2a9-b2a2-47cf-b528-2b46907c8359

DFIR_Sodinokibi_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1069

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34a06e23-b81c-45c7-96bc-7e08d31a4a44

IBM IcedID November 2017

ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:S0483

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--356cef7e-2994-4e52-8985-e046e8cc5513

Cybereason Valak May 2020 · Unit 42 Valak July 2020 · Unit 42 TA551 Jan 2021 · Secureworks GOLD CABIN

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--499d7aed-5889-4f40-a688-660f976dd112

DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4eaced08-4f7d-4085-be86-05e3304792d3

DFIR_Quantum_Ransomware · Trendmicro_IcedID

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f17c215-893f-4c2d-9d9f-944b170d21e5

Trendmicro_IcedID

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b078d28-1724-474c-8668-a6d5c28ed72b

DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f81539c-f287-4f8f-be26-11443d2e19d3

DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82b48b26-b4af-4ce5-9720-6ce05b7441a5

Trendmicro_IcedID

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83e30b05-5658-4cc3-9bac-500ea852e655

Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--891f37e3-9c72-4eed-8fcc-8106dc360a97

Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d36ae15-a2af-4c13-86f0-f657afbb4c86

Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94229aa6-c862-48b8-9959-1e1d3c04dd5e

DFIR_Quantum_Ransomware · IBM IcedID November 2017

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--969d588f-7357-4349-b158-2bf78704c1b4

DFIR_Sodinokibi_Ransomware · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9968edfb-8501-4954-847d-8f873c78e023

Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1055.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6fe230f-9e76-46a5-a235-2990009d8c4a

IBM IcedID November 2017

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8484e9d-ad08-4d2c-8328-24552dd22f35

DFIR_Quantum_Ransomware · IBM IcedID November 2017 · Juniper IcedID June 2020 · Latrodectus APR 2024

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b40f6b8f-c654-4d44-8a1b-72e2cf0fd535

DFIR_Quantum_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7d44225-31cf-4766-b585-debf0ed8d965

DFIR_Sodinokibi_Ransomware · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b82ab6ba-b590-440d-bfd1-75f18560a8b4

DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba575869-1ac0-4681-aee2-37ecd3e6fed5

DFIR_Quantum_Ransomware

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1185

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5e3e18d-124e-4ae2-a95c-9db8f6d53000

IBM IcedID November 2017 · Juniper IcedID June 2020

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cabd44af-9804-4f83-98e0-927719057a62

IBM IcedID November 2017

ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:S0483

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf50c68f-0fbe-4151-99e6-ef29a4959887

TrendMicro Pikabot 2024

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee6b93d4-71f1-4d8c-bc2d-3cbb9b30c866

Juniper IcedID June 2020

ATTACK:enterprise:G1038 → uses → ATTACK:enterprise:S0483

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eeaeb818-cb48-4f67-9975-d783c52f3ca8

Latrodectus APR 2024

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f36f0a5d-a2a6-440f-8d6f-3fbdafb07af0

DFIR_Quantum_Ransomware · IBM IcedID November 2017

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fbf2cca6-d734-49b2-a1a9-6c393b99fd91

IBM IcedID November 2017 · Juniper IcedID June 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.