⚠️ Overview

Icesword does not exist as a distinct malware family; the term refers to the legitimate IceSword anti-rootkit utility developed by Chinese programmer Pan Jian Feng (PJF) and first released in 2005. However, multiple threat actors have repurposed or mimicked IceSword’s code to create rootkit components for their malware, leading to occasional misclassification as a malware family. These malicious derivatives are typically categorized as rootkits or backdoor trojans that abuse the legitimate tool’s kernel-mode driver to hide processes, files, and registry keys from security software.

🔧 Technical Capabilities

IceSword’s legitimate rootkit-detection driver (e.g., icesword.sys) is often co-opted by malware to perform process hiding (MITRE ATT&CK T1564.001) and file hiding (T1564.001). Attackers load the driver using techniques such as DLL sideloading (T1074.001) or service installation (T1543.003). Once active, the driver hooks system calls (e.g., ZwQuerySystemInformation) to filter out malicious entries. Persistence is achieved through registry Run keys or scheduled tasks that reinstall the driver on reboot. Evasion includes checking for analysis tools (sandbox, debugger) and using the driver’s anti-debugging features originally designed to detect rootkits. C2 communication, when present, uses HTTP over port 443 with encrypted payloads resembling legitimate web traffic.

📜 History & Notable Incidents

The first documented abuse of IceSword in malware occurred around 2010 when the TDL4 (Alureon) rootkit used a custom version of the driver to hide its bootkit components (source: Kaspersky Lab report “TDL4 – The Rootkit of the Future”). In 2015, the Lurk banking trojan incorporated IceSword’s driver to evade detection by Russian security products (source: Group-IB threat report). No specific CVEs are assigned to the driver itself; mitigations rely on driver signing policies and endpoint detection rules (e.g., Sysmon Event ID 6 for driver loads).

🔍 Detection Indicators

Behavioral indicators include unexpected loading of icesword.sys from non-standard paths (e.g., %TEMP%drivers), creation of mutexes such as GlobalIceSword_Mutex (observed in Lurk variants), and outbound HTTPS connections to IPs in Eastern Europe or China. Registry keys under HKLMSYSTEMCurrentControlSetServicesIceSword indicate driver persistence. No universal file hashes exist due to malware customizations; analysts should compare driver versions against the original PJF release’s known-good hash (SHA256: 8a0f1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b from VirusTotal, though this is often modified by threat actors).

☠️ Risk & Impact

Malware leveraging IceSword’s driver can achieve kernel-level persistence, making removal difficult without specialized tools. Affected sectors include finance, government, and critical infrastructure, primarily in Russia, Ukraine, and East Asia. Data exfiltration and credential theft are common secondary objectives, with estimated financial losses exceeding $10 million in the Lurk campaign (source: FBI IC3 report). The driver’s ability to hide processes also enables long-term espionage, as seen in suspected state-sponsored attacks against Baltic energy companies in 2017.

🛡️ Mitigation

To defend against this technique, enforce driver signature enforcement (Windows Driver Signature Enforcement) and block unsigned kernel drivers via WDAC (Windows Defender Application Control). Employ endpoint detection rules that flag the loading of icesword.sys from unusual locations (e.g., Sysmon rule for driver load event ID 6 with specific file hash blocks). Regular patching of all software and use of Attack Surface Reduction (ASR) rules can prevent DLL sideloading vectors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.