From IcedID to Dagon Locker in 29 Days Rapid Escalation Infrastructure Map & Technical Deep Dive

Overview

A rapid intruder progression has been observed in which IcedID initial access and loaders lead, within weeks, to Cobalt Strike activity and final Dagon Locker ransomware deployment. This post provides a clean, technical explanation of the attack chain, a concise infrastructure map you can visualize on your site, and a prioritized table of high‑confidence IOCs to block immediately.

Attack infrastructure (service view)

Represent each line below as a mapped node (role, attributes) in your visualization: how the attacker moves from initial delivery to full‑scale ransomware.

Initial Access IcedID

Delivery through malspam, weaponized attachments, or malicious JavaScript delivered via email or drive‑by downloads.
Initial payloads frequently delivered as staged archives or trojanized installers that execute a JavaScript or an executable loader.

Staging & Loader

A lightweight loader drops multiple artifacts: loader stubs, benign‑looking filenames, and module payloads.
The loader often uses packing, string obfuscation, or simple XOR-based transformations to evade static signature detection.

Execution & Persistence (Endpoint)

IcedID runs in user context, performs basic reconnaissance, and deploys secondary payloads such as Cobalt Strike stagers.
Persistence mechanisms include scheduled tasks, service DLLs, registry autoruns, and files placed in %ProgramData% or %AppData%.

Post‑exploitation, Cobalt Strike

Operators use Cobalt Strike beacons to execute commands, move laterally, harvest credentials, and deploy additional tools.
Lateral movement often leverages Windows admin tools, remote services, SMB, WMI, and stolen credentials.

Ransomware Phase, Dagon Locker

Once sufficient access and privileges are obtained, operators deploy Dagon Locker across target systems.
Typical ransomware behavior: selective encryption, deletion of backups and shadow copies, and exfiltration of high‑value data prior to encryption.

Operator Infrastructure

C2 servers, staging domains, dynamic DNS, and operator panels that orchestrate payload delivery, beaconing, updates, and encryption tasks.

Technical attack flow

1. Delivery and execution

Phishing messages or compromised websites distribute malicious attachments (e.g., Document_Scan_468.js) or archives. When executed, the JavaScript or loader initiates the staged download of the IcedID payload.
Loaders frequently masquerade as legitimate installers and may include execution tricks such as using mshta, wscript, or benign‑looking binaries to execute the malicious code.

2. Loader behavior and unpacking

The loader unpacks or decodes embedded payloads into disk or memory. Techniques include:

Dropping DLLs and invoking them via rundll32 or side‑loading into signed binaries.
Reflective loading into memory to avoid writing fully formed binaries to disk.
Runtime deobfuscation of strings and API names.

3. Initial beaconing and reconnaissance

IcedID beacons to hardcoded IPs or domains over HTTPS to blend with normal traffic. Typical actions include:

Collecting host metadata (hostname, username, OS version).
Enumerating running processes, open ports, mapped drives, and local shares.
Searching for credentials stored in browsers, configuration files, or accessible credential stores.

4. Staging Cobalt Strike

The initial implant fetches or drops a Cobalt Strike stager. Cobalt Strike beaconing patterns can include:

Periodic HTTP(S) GET/POST with small encrypted payloads.
Use of randomized URIs or dynamic domain generation.
Custom headers or encoded content to hide C2 communications.

5. Lateral movement and privilege escalation

Using harvested credentials and legitimate admin tools, operators:

Move laterally via RDP, SMB, and remote service execution.
Execute remote commands and deploy additional tooling.
Attempt to escalate privileges via known misconfigurations, local exploits, or credential reuse.

6. Persistence and tool staging

Operators install backdoors, scheduled tasks, and service DLLs (examples: Riadnc1.dll, update.dll) to survive reboots and maintain access.
Scripts and batch files (e.g., magni.w, magni.w.bat) are used to orchestrate staging and execution across multiple hosts.

7. Exfiltration and ransomware deployment

High‑value data is aggregated and exfiltrated using secured channels, after which Dagon Locker or equivalent ransomware is dropped.
Ransomware encrypts files and may attempt to destroy snapshots, delete backups, and remove forensic artifacts to complicate recovery efforts.

Capabilities observed

Multi‑stage infection: loader → IcedID → Cobalt Strike → ransomware.
Memory‑only or minimized‑disk footprint techniques (reflective loading, in‑memory unpacking).
Credential harvesting (browsers, RDP, stored credentials).
Lateral movement via SMB, remote services, and remote execution tooling.
Resilient persistence (services, scheduled tasks, autoruns).
Data staging and exfiltration prior to encryption.
Use of dynamic hosting and domain fronting to hinder takedown.

Prioritized IOCs to block

Block these immediately at DNS, firewall, and proxy layers; ingest the hashes into EDR/AV and run hunts for the filenames and modules.

Forensic collection checklist

If you suspect compromise, collect and preserve the following artifacts for analysis:

Full memory dump (captures injected modules, unpacked payloads, and credentials in memory).
Disk images or copies of suspicious files and DLLs.
Windows Event Logs (Security, System, Application), and Sysmon logs if enabled.
Scheduled task XML files, service registry entries, and autorun keys.
Browser profiles and cookie stores for credential recovery or replay analysis.
Network captures (PCAP) showing connections to listed IPs/domains.

Preserve chain of custody for collected evidence if legal action or law enforcement engagement is anticipated.

Detection engineering and hunting guidance

Use the following detection primitives to build SIEM rules and hunting queries:

Network anomalies

Outbound HTTPS to the listed IPs or to unusual domains in short intervals.
Repeated POSTs with small encrypted payloads or suspicious content types.
DNS queries to newly registered domains or domains with known malicious patterns.

Endpoint telemetry

Execution of .js from email or %Temp% with names like Document_Scan_.
New scheduled tasks or service registrations created by non‑standard installers or user contexts.
DLLs loaded from user profile paths or application subfolders where they do not typically belong.
Parent/child process anomalies: benign signed binary spawning network‑connected child process running from user path.

Credential and lateral movement

High volume of authentication failures followed by successes for privileged accounts.
Remote executions using PsExec, WMIC, SMB, or scheduled tasks triggered across multiple hosts.

Ransomware indicators

Rapid, recursive file modifications across multiple shares and systems.
Creation of ransom notes, unusual file extensions, or mass deletion of shadow copies.

Hardening and mitigation recommendations

Enforce application allow‑listing and restrict execution from %Temp%, user profile directories, and email attachments.
Implement network segmentation and restrict lateral movement using ACLs and host‑based firewall rules.
Require MFA for all privileged and remote access, and rotate credentials regularly.
Maintain offline, immutable backups and test restoration procedures.
Enable centralized logging (Sysmon, EDR) and retain logs for investigation windows sufficient to capture multi‑stage intrusions.
Apply least privilege to service accounts and reduce the number of accounts with administrative rights.

Incident response playbook

1. Triage: Confirm presence of IOCs in telemetry; identify affected hosts and scope.
2. Contain: Block IOCs at network edge; isolate infected machines.
3. Collect: Acquire memory dumps, disk artifacts, and relevant logs.
4. Analyze: Extract C2 configs, map lateral movement, identify data exfiltration.
5. Eradicate: Remove malware, delete malicious tasks/services, and rebuild hosts if necessary.
6. Recover: Restore from backups; validate systems before reconnecting.
7. Communicate: Notify internal stakeholders, customers, and, where appropriate, national CERTs or law enforcement.

Final notes

This rapid‑escalation campaign underscores the importance of detecting and blocking loader and staging infrastructure early. Ingest the prioritized IOC list above, harden endpoints against execution from untrusted locations, and ensure robust logging to catch multi‑stage behaviors. If you want, we can provide the full IOC set in CSV/JSON format, produce platform‑specific detection rules for your SIEM/EDR, or generate an illustrative infrastructure diagram for your website.