VERY IMPORTANT

As part of our ongoing tracking of IcedID / BokBot, Team Cymru wanted to share some insights derived from infrastructure associated with IcedID’s BackConnect (BC) protocol. When deployed post “initial” compromise, the BC protocol allows the threat actor(s) additional functionality, using the infected host as a proxy.