Cold as Ice: Unit 42 Wireshark Quiz for IcedID
Summary: Unit 42 published a Wireshark quiz built on a packet capture from an IcedID infection that occurred in April 2023 in an Active Directory environment, similar to earlier IcedID activity from March 24, 2023. IcedID, also known as BokBot, is Windows-based malware that can lead to ransomware, and the pcap is downloadable from Unit 42's GitHub repository as a ZIP archive unlocked with the password "infected".
What's compelling: IcedID has been a relatively constant presence in the 2023 threat landscape and can lead to ransomware, so the traffic in this April 2023 capture is the same pattern defenders would need to recognize inside an Active Directory environment.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Identity & Access Management
- Related
- FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’ Cyber Risks · Nov 13, 2026Connect Wise Cloud Backup application abused in cross-tenant token sweep Cyber Risks · Oct 19, 2026Sponsored: Specter Ops on the impact of AI agents on Blood Hound Cyber Risks · Sep 20, 2026