A Data Exfiltration Attack Scenario: The Porsche Experience

The threat actors linked to the malware loader known as IcedID have made updates to the BackConnect (BC) module that’s used for post-compromise activity on hacked systems, new findings from Team Cymru reveal.

IcedID, also called BokBot, is a strain of malware similar to Emotet and QakBot that started off as a banking trojan in 2017, before switching to the role of an initial access facilitator for other payloads. Recent versions of the malware have been observed removing functionality related to online banking fraud to prioritize ransomware delivery.

The BackConnect (BC) module, first documented by Netresec in October 2022, relies on a proprietary command-and-control (C2) protocol to exchange commands between a server and the infected host. The protocol, which comes with a VNC component for remote access, has also been identified in other malware such as the now-discontinued BazarLoader and QakBot.

In December 2022, Team Cymru reported the discovery of 11 BC C2s active since July 1, 2022, noting that operators likely located in Moldova and Ukraine are overseeing distinct elements of the BC protocol.

"For the past several months, BackConnect traffic caused by IcedID was easy to detect because it occurred over TCP port 8080," Palo Alto Networks Unit 42 said in late May 2023. "However, as early as April 11, 2023, BackConnect activity for IcedID changed to TCP port 443, making it harder to find."

The latest analysis of the attack infrastructure from Team Cymru has revealed that the number of BC C2s have shot up from 11 to 34 since January 23, 2023, with the average uptime of a server significantly reducing from 28 days to eight days.

"Since April 11, 2023, a total of 20 high confidence BC C2 servers were identified, based on pivots from management infrastructure," the cybersecurity firm said in a report shared with The Hacker News.

"The first observation is that the number of concurrent C2 servers in operation has increased [...], with as many as four C2 servers receiving management communications on a particular day."

A further examination of the traffic originating from BC C2 servers has uncovered as many as eight candidate victims between late April 2023 and June 2023 that "communicated with three or more BC C2s over a relatively long period of time."