Imagine facing a list of the most commonly used malware variants for initial access. As the Dutch Police, where would you begin your investigation? In this talk, I will guide you through one of the investigations from Operation Endgame, where we began with just the name of the malware: IcedID. I will illustrate the complexities involved in tracking and dismantling the malware infrastructure, as well as apprehending the cybercriminals behind it.