Inside the IcedID BackConnect Protocol (Part 2)

Introduction

In this blog post, we will provide an update on our continued analysis and tracking of infrastructure associated with IcedID’s BackConnect (BC) protocol; a continuation of the analysis we shared in late-December 2022, which you can read ,here, in addition to our ,campaign metrics and ,infrastructure tracking blog posts.

Note: whilst the same BC protocol is utilized by several other threat operations, including Bazar and QakBot, this blog post focuses specifically on IcedID infrastructure.

Given that it is …

addition analysis blog blog post blog posts campaign december icedid infrastructure introduction malware analysis metrics posts protocol tracking update