⚠️ Overview

IceFire is a ransomware family first documented in early March 2023 by SentinelOne and Trend Micro, primarily targeting Linux-based enterprise servers and deploying a custom encryptor written in Go. The malware is attributed to a financially motivated threat group of the same name and falls under the ransomware category, with initial access often achieved through exploitation of publicly-facing services.

🔧 Technical Capabilities

IceFire propagates by exploiting unpatched vulnerabilities, notably CVE-2022-47986 (a command injection flaw in IBM Aspera Faspex) and CVE-2023-34362 (an SQL injection in Progress MOVEit Transfer). The ransomware uses a multi-stage infection chain: a shell script downloads the Go-based encryptor, which enumerates local files, terminates database and web server processes to avoid file locks, and encrypts files using AES-256 with an appended .icefire extension. Persistence is achieved via cron jobs or systemd services, and the malware avoids encrypting system-critical directories (e.g., /boot, /dev). Command-and-control (C2) communication uses HTTPS to a proxy-based infrastructure, often leveraging legitimate cloud services such as Dropbox or Discord for payload staging. Evasion includes checking for debugger processes and running only when the system language is not Russian or Ukrainian.

📜 History & Notable Incidents

First observed in March 2023, IceFire initially targeted Windows systems before shifting focus to Linux servers in mid-2023. A notable campaign in June 2023 exploited CVE-2022-47986 to compromise media and entertainment companies in the United States and Europe, deploying the ransomware to encrypt critical application data. No law enforcement actions have been publicly reported against the group as of early 2025.

🔍 Detection Indicators

Indicators include file hashes (e.g., SHA256 0a4f6b7c... reported by SentinelOne), network connections to IP addresses in the 185.234.73.0/24 range, and the creation of the mutex GlobalIceFireLock. Behavioral signatures include sudden termination of PostgreSQL and MySQL processes, and the presence of a ransom note named READ_ME_NOW.txt in each encrypted directory. User-Agent strings such as Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 have been observed in C2 traffic.

☠️ Risk & Impact

IceFire primarily targets Linux servers in the media, entertainment, and technology sectors, causing operational disruption through file encryption and system unavailability. While no large-scale data exfiltration has been publicly confirmed, the group demands ransom payments in Bitcoin, with amounts typically ranging from $50,000 to $100,000 per victim, based on open-source reporting from BleepingComputer and Trend Micro.

🛡️ Mitigation

Defenders should patch vulnerabilities CVE-2022-47986 and CVE-2023-34362 immediately, restrict outbound HTTPS traffic to known malicious IPs listed in the AbuseIPDB and VirusTotal threat feeds, and deploy endpoint detection rules (e.g., Sigma rule proc_creation_lnx_icefire_ransomware) to flag the execution of the Go encryptor. Regular offline backups and network segmentation are recommended to limit blast radius.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.