IcedID and Pikabot sit at the same point in a ransomware intrusion: the first foothold, sold or handed to an operator who then takes the network. IcedID started in 2017 as a banking trojan and was reshaped into a loader; Pikabot appeared in early 2023 and filled the gap left by the QakBot takedown in August 2023. Both were named targets of Operation Endgame in May 2024. This guide covers how each family evolved, the brokers that distributed them, the ATT&CK v20 techniques recorded against S0483 and S1145, what an infection means for the identities on the host, and the detections and controls that hold up when the builds change. It is written for SOC analysts, detection engineers and email and endpoint owners, at recognition level only. For the loader class in general, see the Malware Loaders and Droppers Guide.
Key takeaways
- Treat either family as a pre-ransomware alert. Proofpoint linked IcedID implants to Maze, Egregor and Sodinokibi events, and Trend Micro tied the main Pikabot distributor to Black Basta ransomware through Cobalt Strike follow-on.
- IcedID changed purpose, not just code. Proofpoint documented Lite and Forked variants in 2022 and 2023 that dropped the web inject banking features to focus on delivering other malware.
- Pikabot is built to defeat analysis. MITRE records debugger checks, sandbox checks, steganography in PNG resources, reflective loading and injection into legitimate Windows processes.
- Brokers, not end users, run them. ATT&CK links IcedID to TA551 and TA578 and Pikabot to TA577, all email distribution groups that resell access.
- Behaviour outlives builds. Elastic noted that the February 2024 Pikabot build simplified its obfuscation; process chains, injection telemetry and odd-port HTTPS stay detectable when signatures break.
Names, lineage and status
| Name or ID | Source | What it refers to |
|---|---|---|
| IcedID (S0483) | MITRE ATT&CK | Modular banking malware observed since at least 2017; downloaded by Emotet in multiple campaigns |
| Standard IcedID | Proofpoint | Long-running variant used by nearly all tracked actors; keeps web injects and backconnect |
| IcedID Lite | Proofpoint | First seen November 2022 as a follow-on payload after Emotet infections; minimal check-in data, downloads a bot pack |
| Forked IcedID | Proofpoint | First seen February 2023 with a separate loader and panel; web inject functionality removed |
| Pikabot (S1145) | MITRE ATT&CK; Zscaler | Backdoor and loader active since early 2023, used for initial access and follow-on tool deployment |
| Water Curupira Pikabot Distribution (C0037) | MITRE ATT&CK; Trend Micro | 2023 email distribution by an entity linked to Black Basta ransomware deployment |
| Pikabot Distribution February 2024 (C0036) | MITRE ATT&CK; Elastic | Link-based campaign delivering a simplified Pikabot build |
MITRE notes that Pikabot has some overlaps with QakBot but that there is insufficient evidence to link the two families definitively. Zscaler reported that Pikabot became very active after the QakBot takedown, and Trend Micro suggested it may be a QakBot replacement. Proofpoint assesses that Latrodectus was likely written by the IcedID developers; see the Latrodectus and Bumblebee Loaders Guide. This page names no individuals. For the families that fed and replaced these loaders, see the Emotet Malware Guide and the QakBot Malware Guide.
From banking trojan to access tool
IcedID's original job was fraud: ATT&CK records web injection that redirected victims to spoofed sites to harvest banking credentials (T1185 Browser Session Hijacking). Proofpoint's 2023 analysis described a deliberate shift. The Lite and Forked variants removed web injects, adversary-in-the-middle and backconnect features, which Proofpoint linked to declining banking fraud returns and a focus on delivering other malware, including ransomware. The Standard variant stayed in use alongside them.
Pikabot never had a fraud role. MITRE describes it as frequently used to deploy follow-on tools such as Cobalt Strike or ransomware, and Elastic's analysis of the February 2024 build lists command execution, discovery, file and registry changes, process enumeration and injection as core capabilities. For defenders, the practical point is the same for both: the payload you find is a delivery mechanism, and the real risk is whatever it fetched next.
| Aspect | IcedID | Pikabot |
|---|---|---|
| First observed | 2017 (banking trojan) | Early 2023 (loader and backdoor) |
| Distributors recorded | TA551, TA578 (ATT&CK); TA577, TA544, TA581 (Proofpoint) | TA577 (ATT&CK); Water Curupira (Trend Micro) |
| Typical follow-on | Cobalt Strike, then ransomware (Maze, Egregor, Sodinokibi in Proofpoint reporting) | Cobalt Strike, then Black Basta (Trend Micro); ransomware variants (MITRE) |
| Execution host process | rundll32.exe, msiexec.exe | rundll32.exe for the DLL; injected into ctfmon.exe, SearchProtocolHost.exe or WerFault.exe |
| Command and control | HTTPS (T1071.001, T1573.002) | HTTPS on non-standard ports such as 2967 and 2223 (T1571) |
| Disrupted by | Operation Endgame, May 2024 | Operation Endgame, May 2024 |
Delivery chains to recognise
Described for recognition and blocking, not replication. Proofpoint and Trend Micro reported these patterns:
- Thread hijacking: replies inserted into real email conversations, likely stolen from earlier victims, sent from new domains or free mail accounts with a short note asking the recipient to open the attachment. TA551 used this for IcedID and Water Curupira for Pikabot.
- Password-protected archives: ZIP files with the password in the email body, holding a disk image with a shortcut file disguised as a document plus a DLL, or heavily obfuscated JavaScript. See the Malicious LNK Files Guide.
- PDF lures: PDFs posing as OneDrive attachments that link to a JavaScript downloader (Pikabot, Q4 2023).
- HTML smuggling and OneNote: HTML smuggling of a password-protected WSF file and OneNote attachments hiding an HTA behind a fake "open" button (IcedID, early 2023). See the HTML Smuggling Guide and the OneNote Malware Delivery Guide.
- Office macros: Word and Excel files with embedded macros (IcedID, recorded by ATT&CK under T1204.002).
- Contact forms and themed lures: TA578 used "stolen images" and "copyright violation" lures, and ATT&CK records contact form use by the group.
- Link to ZIP to script: in February 2024 emails linked to ZIP archives with obfuscated JavaScript that used PowerShell to fetch an executable into the Public user folder (Elastic).
Tactics and techniques (MITRE ATT&CK v20)
Every ID below is recorded in ATT&CK v20 against S0483 or S1145 and was checked against the v20 dataset. Tactic names follow v20, where Stealth replaces the older defence evasion grouping for these techniques.
| Tactic | Technique | Family | Primary defence |
|---|---|---|---|
| Initial access | T1566.001 Spearphishing Attachment; T1189 Drive-by Compromise (cloned sites) | IcedID | Block risky attachment types; web filtering for newly registered domains |
| Execution | T1204.002 Malicious File; T1059.005 Visual Basic; T1047 Windows Management Instrumentation | IcedID | Block macros from the internet; script handlers set to Notepad |
| Execution | T1059.003 Windows Command Shell | Pikabot | Process creation logging with command line |
| Persistence | T1053.005 Scheduled Task (IcedID); T1547.001 Registry Run Keys (both) | Both | Alert on tasks and Run keys pointing at user-writable paths |
| Stealth | T1218.011 Rundll32; T1218.007 Msiexec; T1055.012 Process Hollowing | IcedID | Application control for proxy execution from user paths |
| Stealth | T1055.003 Thread Execution Hijacking; T1055.002 Portable Executable Injection; T1620 Reflective Code Loading | Pikabot | EDR memory and call-stack telemetry |
| Stealth | T1027.003 Steganography (both); T1480.001 Environmental Keying (Pikabot) | Both | Behaviour detection rather than static signatures |
| Stealth and discovery | T1497 Virtualization/Sandbox Evasion (IcedID); T1497.001 System Checks and T1622 Debugger Evasion (Pikabot) | Both | Realistic sandbox images plus EDR on real hosts |
| Discovery | T1482 Domain Trust Discovery; T1082 System Information Discovery; T1016 System Network Configuration Discovery | Both | Alert on trust and domain enumeration from user workstations |
| Discovery | T1087.002 Domain Account; T1135 Network Share Discovery; T1518.001 Security Software Discovery; T1614.001 System Language Discovery | IcedID | Correlate bursts of discovery commands after a mail click |
| Collection | T1185 Browser Session Hijacking | IcedID | Phishing-resistant MFA; browser protection |
| Command and control | T1071.001 Web Protocols; T1573.002 Asymmetric Cryptography; T1105 Ingress Tool Transfer | IcedID | TLS-inspecting proxy; block uncategorised destinations |
| Command and control | T1571 Non-Standard Port | Pikabot | Egress allow-listing for HTTPS to 443 through the proxy only |
| Exfiltration | T1041 Exfiltration Over C2 Channel | Pikabot | Egress monitoring per host |
Related techniques such as T1059.007 JavaScript and T1566.002 Spearphishing Link appear in the delivery reporting above but are not recorded against S0483 or S1145 in ATT&CK; map them to the campaign rather than the malware.
Where identity fits
- Stolen threads are stolen identities: thread hijacking works because the lure arrives inside a real conversation from a mailbox compromised earlier. A supplier's mailbox compromise becomes your initial access risk.
- The infected user's sessions: once running, the loader acts as the user. Browser cookies, cached tokens and saved credentials on that host are available to the follow-on operator, and IcedID's original web inject function targeted credentials directly.
- Domain reconnaissance with ordinary rights: both families gather domain trust and host information, and IcedID queries LDAP and runs built-in commands to find more users. A standard domain user can read most of Active Directory by default, which is what makes this step quiet.
- Hand-off to a second operator: Cobalt Strike follow-on means a more capable operator may hold the user's session before the loader alert is triaged. See the Cobalt Strike Abuse Detection Guide and the Initial Access Brokers Guide.
Notable events
| Date | Event | Source |
|---|---|---|
| 2017 | IcedID first observed as banking malware | MITRE ATT&CK; Proofpoint |
| 2020 to 2021 | IcedID implants linked to Maze, Egregor and Sodinokibi ransomware events | Proofpoint |
| November 2022 | IcedID Lite seen as a follow-on payload after Emotet infections | Proofpoint |
| February 2023 | Forked IcedID campaigns, including one of over 13,000 messages on 3 February | Proofpoint |
| Early 2023 | Pikabot emerges; Water Curupira spam campaigns from Q1, paused late June to early September | Zscaler; Trend Micro |
| August 2023 | QakBot takedown; Pikabot phishing increases in Q4 2023 | Zscaler; Trend Micro |
| February 2024 | New Pikabot build with reduced code complexity and simplified obfuscation | Elastic; MITRE ATT&CK C0036 |
| 27 to 29 May 2024 | Operation Endgame: over 100 servers taken down and four arrests, targeting IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot | Europol |
A takedown removes infrastructure, not the business model. Expect rebuilt variants and replacement loaders; keep detections behaviour-based and see the DarkGate Malware Guide, a family Trend Micro saw in the same distributor's campaigns.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| wscript.exe or cscript.exe running a script from Downloads or an archive temp folder, then spawning PowerShell, cmd.exe or curl.exe | EDR; Sysmon Event ID 1; Security Event ID 4688 with command line | First stage of the 2023 and 2024 Pikabot chains |
| A shortcut from a mounted disk image launching rundll32.exe against a DLL in the same image or a user path | EDR process tree | Pikabot IMG and LNK chain; IcedID rundll32 execution |
| Executables written to C:\Users\Public and run shortly after | EDR file and process events; Sysmon Event ID 11 | February 2024 Pikabot staging location |
| Suspended creation of ctfmon.exe, SearchProtocolHost.exe or WerFault.exe by an unusual parent, followed by remote memory writes | EDR injection and call-stack telemetry; Sysmon Event IDs 8 and 10 | Pikabot core injection |
| msiexec.exe making outbound HTTPS connections with no installation activity | EDR network events; Sysmon Event ID 3 | IcedID injection into msiexec to beacon |
| Domain trust, group and share enumeration from a user workstation soon after a mail click | EDR; domain controller logs | Broker reconnaissance before sale |
| HTTPS to raw IP addresses on ports such as 2967 or 2223, or an Outlook user-agent from a non-Outlook process | Firewall, proxy and DNS logs | Pikabot command and control described by MITRE and Elastic |
| New scheduled task or Run key pointing into AppData or Public | Security Event ID 4698; Sysmon Event IDs 12 and 13 | Persistence for both families |
Specific indicators (hashes, IP addresses, domains) age within weeks. Use the vendor reports for retro-hunting, and build durable rules on the process and network behaviours above. See the EDR Telemetry Guide.
Phased hardening plan
- Cut the delivery formats: block disk images, password-protected archives, script files, HTA, WSF and OneNote attachments from external mail, and apply the same rules to web downloads. Run in quarantine-and-report mode for one to two weeks to find legitimate senders, then enforce. Roll back by returning the rule to report mode. See the Email Security Guide.
- Defang scripts and macros: associate .js, .jse, .vbs, .wsf and .hta with Notepad by Group Policy, and block macros in files from the internet. Pilot on one business unit first; roll back by unlinking the GPO.
- Control proxy execution: WDAC or AppLocker rules that stop rundll32.exe and msiexec.exe loading content from user-writable paths, starting in audit mode and reviewing hits for a fortnight before enforcing.
- Constrain egress: force web traffic through the proxy and block direct outbound HTTPS from workstations on non-standard ports. This alone breaks Pikabot's odd-port command and control.
- Remove local admin: standard user accounts for daily work, with Windows LAPS for the local administrator. See the LAPS Guide.
- Automate first response: on a high-confidence loader verdict, isolate the host, revoke the user's sessions and refresh tokens, reset the password and start an estate-wide hunt for Cobalt Strike and the same process chains.
Decision guidance
- Small organisations: attachment-type blocking, Notepad as script handler, macro blocking, no local admin and proxy-only egress remove most of both chains at low cost. An MDR service can cover the response step.
- Large organisations: add application control, call-stack aware EDR rules for the injection patterns above, and session revocation tied to EDR verdicts.
- Clean or rebuild: rebuild. A loader's purpose is to fetch unknown payloads, so a clean scan does not prove the host is clean. Hunt for follow-on tooling before declaring containment.
- Sandbox or EDR: both, but do not rely on detonation. Both families check for analysis environments and may stay quiet.
Metrics
- Percentage of inbound mail carrying disk images, scripts or encrypted archives that is blocked or quarantined.
- Percentage of endpoints where script file types open in Notepad.
- Percentage of workstations that can reach the internet on non-standard ports directly.
- Percentage of users without local admin rights.
- Median time from loader alert to host isolation and session revocation.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Malicious code and spam protection | SI-3, SI-8 | DE.CM-09 |
| Application control and least functionality | CM-7(5), CM-7 | PR.PS-01 |
| Boundary protection and egress filtering | SC-7 | PR.IR-01 |
| Least privilege (no local admin) | AC-6 | PR.AA-05 |
| Monitoring and analysis | SI-4, AU-6 | DE.CM-01, DE.AE-02 |
| Incident handling | IR-4 | RS.MA-01 |
Common failure patterns
- Closing the ticket at quarantine: the loader may already have fetched Cobalt Strike; without session revocation and a hunt, the follow-on operator stays.
- Trusting replies in known threads: thread hijacking defeats "do you know the sender" training; train on unexpected archives and passwords in the email body instead.
- Allowing encrypted archives through: a password in the body means the gateway cannot inspect the content, which is exactly why both families used it.
- Open egress on any port: workstations that can make HTTPS connections on ports like 2967 hand Pikabot its command channel.
- Signature-only detection: Elastic expected new signatures to break as the build changed; rules on injection and process chains survive.
- Users as local admins: persistence, injection and follow-on tools work more easily when the user can install anything.
Practitioner checklist
- Block disk images, scripts, HTA, WSF, OneNote and password-protected archives from external mail and downloads.
- Make Notepad the default handler for Windows script files and block macros from the internet.
- Enforce WDAC or AppLocker rules against rundll32 and msiexec loading from user paths.
- Force web egress through the proxy; block direct HTTPS on non-standard ports.
- Alert on suspended creation of ctfmon, SearchProtocolHost or WerFault followed by remote memory writes.
- Alert on executables launched from C:\Users\Public and on Run keys or tasks pointing there.
- Remove local admin rights and deploy Windows LAPS.
- On loader detection, isolate, revoke sessions, reset credentials, rebuild and hunt estate-wide for Cobalt Strike.
Standards and references
- MITRE ATT&CK: IcedID (S0483)
- MITRE ATT&CK: Pikabot (S1145)
- Europol: Largest ever operation against botnets hits dropper malware ecosystem
- Proofpoint: Fork in the Ice, the New Era of IcedID
- Proofpoint: The First Step, Initial Access Leads to Ransomware
- Elastic Security Labs: PIKABOT, I choose you
- Trend Micro: A Look Into Pikabot Spam Wave Campaign
- Zscaler ThreatLabz: Automating Pikabot's String Deobfuscation
Related NHI Mgmt Group resources: Malware Loaders and Droppers Guide · Emotet Malware Guide · QakBot Malware Guide · DarkGate Malware Guide · Black Basta Threat Actor Profile