IcedID with Cobalt Strike and Dark VPN

Share This Post

IcedID has been being seen quite a bit in the wild recently. Brad Duncan, Threat Intelligence Analyst at Palo Alto Networks, has shared a blog on SANS reviewing the a recent IcedID infection which lead to Dark VPN activity and Cobalt Strike.

IcedID had it’s start as a modular banking trojan aimed at stealing user financial information, but is also capable and has been being used as a dropper for other malware. IcedID has been recently seen coming within a password protected ZIP attachment, which contains an ISO image containing the hidden malware, but previously has also been seen as a secondary payload to other droppers, such as Emotet.

With it’s popularity recently, IcedID is definitely a piece of malware defenders need to be aware of, and sharpen up on ways to detect it in their environments.

Brad Duncan’s post and included IoCs can be found here: https://isc.sans.edu/diary/rss/28884



Reach out to our incident response team for help

More To Explore

Information Security News – 10/27/2025

AWS Outage Exposes ‘Dangerous’ Over-Reliance on US Cloud Giants Article Link: https://www.datacenterknowledge.com/outages/aws-outage-exposes-dangerous-over-reliance-on-us-cloud-giants Microsoft Threatens to Ram Copilot into Exchange Server On-Prem Article Link: https://www.theregister.com/2025/10/23/copilot_exchange_server/ Ransomware

Information Security News – 10/20/2025

Arup’s $25M Deepfake Loss: Anatomy of an AI-Powered Scam Article Link: https://www.adaptivesecurity.com/blog/arup-deepfake-scam-attack U.S. Warns That Hackers Using F5 Devices to Target Government Networks Article Link:

Do You Want to Shore Up Your Defenses?

We're opening our first round of threat hunting engagements to 100 organizations. Sign up or join the wait list here.