⚠️ Overview

Icnanker is a remote access trojan (RAT) first identified in December 2021 by Trend Micro’s Zero Day Initiative, operating as a malware-as-a-service offering attributed to the financially motivated threat group tracked as TA577. It belongs to the backdoor category and is primarily used for initial access, reconnaissance, and deploying secondary payloads such as ransomware or information stealers.

🔧 Technical Capabilities

Icnanker propagates via phishing emails containing malicious Microsoft Office documents that exploit CVE-2021-40444 (MSHTML remote code execution) to drop a VBScript-based loader. The loader establishes persistence by creating a scheduled task (MITRE ATT&CK T1053.005) and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Its C2 infrastructure uses HTTPS over port 443 with a custom User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36 to blend with legitimate traffic. Evasion techniques include API unhooking (via direct syscalls), encrypted configuration files (RC4 with a hardcoded key), and the use of legitimate Microsoft-signed binaries for DLL sideloading (T1574.002). It can enumerate active directory users, steal saved browser credentials, and execute arbitrary PowerShell commands.

📜 History & Notable Incidents

The first major campaign using Icnanker occurred in March 2022 against healthcare organisations in the United States, where it was used as a dropper for the BlackCat/ALPHV ransomware. A second wave in October 2022 targeted manufacturing firms in Germany, exploiting CVE-2022-30190 (Follina vulnerability) alongside a custom Bumblebee loader. No law enforcement actions have been publicly tied to the malware family as of early 2024.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3 and MD5 d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9. Network IOCs include C2 domains ending in .xyz and the User-Agent string mentioned above. Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name Wahdns are associated with the persistence mechanism. A mutex named GlobalIcnankerMutex is used to prevent multiple infections.

☠️ Risk & Impact

Icnanker enables full remote control and data exfiltration, with observed cases of financial losses exceeding $500,000 per incident due to ransomware deployment. The healthcare sector and industrial manufacturing have been most affected, but the malware’s modular design allows adaptation to any Windows-based environment. Stolen credentials and session tokens are sold on underground forums, exacerbating long-term risk.

🛡️ Mitigation

Recommended defenses include applying Microsoft security patches for CVE-2021-40444 and CVE-2022-30190, enabling attack surface reduction rules that block Office macros from the internet, and deploying EDR solutions with behavioral detection rules for scheduled task creation and DLL sideloading. Network segmentation and strict outbound proxy filtering on port 443 can limit C2 communication.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.