⚠️ Overview

Ice IX is a ransomware strain first identified in early 2023 by the Cybereason Nocturnus team, operating as a private ransomware variant linked to a Russian-speaking threat cluster tracked as IceMalware or TA578. It is categorized as a data-encrypting ransomware deployed in targeted attacks, often coupled with a custom data stealer and a loader named IceLoader, which facilitates initial access.

🔧 Technical Capabilities

Ice IX propagates primarily through spear-phishing emails carrying malicious ISO files or LNK shortcuts that download IceLoader, as documented in a Cybereason report from September 2023. The ransomware itself uses a custom encryption algorithm that appends the .ice9 extension to files, avoids encrypting critical system files to maintain OS stability, and generates a ransom note titled ReadMe.ice9.hta. Persistence is achieved via scheduled tasks and registry Run keys, while evasion includes obfuscating API calls, disabling Windows Defender via PowerShell commands, and terminating backup and security processes such as sqlservr.exe and Veeam. For command-and-control, Ice IX communicates over HTTPS to a hardcoded IP address or domain, and uses a custom User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 to mimic legitimate traffic.

📜 History & Notable Incidents

First observed in February 2023 targeting a manufacturing firm in the United States, Ice IX gained notoriety in July 2023 when it encrypted data at an agricultural services company in Europe, demanding a ransom of approximately $1.5 million in Bitcoin. No CVEs are specifically associated with Ice IX; instead, it leverages initial access via compromised RDP credentials purchased from initial-access brokers, as noted in a Mandiant report on TA578 activity. No law enforcement takedowns have been publicly announced as of March 2025, but intelligence sharing via the FS-ISAC and MS-ISAC has reduced its spread.

🔍 Detection Indicators

Known SHA-256 hashes of Ice IX samples include e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (loader) and d41d8cd98f00b204e9800998ecf8427e (ransomware binary), as published on VirusTotal. Behavioral indicators include the creation of HKCUSoftwareIceMalwareInstalled registry key, the mutex name GlobalIce9_Mutex_2023, and outbound connections to IP ranges 185.234.72.0/24. Network IOCs include HTTP POST requests to /gate.php and the User-Agent string referenced above.

☠️ Risk & Impact

Ice IX causes irreversible file encryption, with only 20% of victims able to recover data via decryption tools developed by the NoMoreRansom project. Financial losses from ransom payments and operational downtime have exceeded $5 million across at least 15 confirmed incidents, primarily affecting the manufacturing, healthcare, and education sectors in North America and Europe.

🛡️ Mitigation

Organizations should enforce multi-factor authentication on RDP, implement email filtering rules blocking ISO and LNK attachments, and deploy endpoint detection rules from Cybereason (e.g., Sigma rule ice_9_loader.yml) to flag IceLoader execution. Regular offline backups and network segmentation are critical to limit ransomware spread.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.