Unidentified 111

Latrodectus, also known as BlackWidow and Unidentified 111, is a malware threat cluster documented as a successor or evolution of IcedID and commonly assessed as a malware delivery and ransomware-precursor operation. It has been observed in multi-stage intrusion chains in which an initial loader executes an embedded .NET component and launches an IcedID payload that subsequently retrieves Latrodectus stage-two malware. Activity associated with Latrodectus has been linked to daily rotating domain infrastructure and delivery patterns consistent with traffic-distribution-driven malware campaigns. The cluster uses staged execution, signed installer packages, and custom action abuse to gain execution while reducing user suspicion and bypassing trust controls. Observed tradecraft includes abuse of Windows Installer packages built with WiX custom actions, execution through rundll32, runtime API resolution, and masquerading through deceptive exports, all of which support defense evasion and post-compromise payload delivery. Associated beaconing behavior includes host fingerprinting and retrieval of follow-on payloads from active command-and-control infrastructure. Latrodectus activity has been assessed as operating in a malware-as-a-service style ecosystem and has been associated with delivery patterns aligned with TA577 or TA551. Infections are treated as high-risk precursor events because IcedID-linked access has historically preceded ransomware deployment by other actors. The dominant role of Latrodectus in observed reporting is as an initial-access and follow-on malware delivery capability rather than as a ransomware brand itself.