Loading malware…
Latrodectus, also known as IceNova and BLACKWIDOW, is a Windows malware loader first discovered in October 2023. It provides initial access and delivery of additional payloads in financially motivated campaigns, including activity associated with ransomware operations. Distributors include TA577, TA578, and Storm-0249. Observed campaigns have targeted financial, automotive, and business sectors, as well as U.S. users and organizations through tax-themed phishing.
Distribution commonly involves spam or targeted phishing emails containing malicious links or attachments. TA578 has also initiated contact through website contact forms using fake copyright complaints. Typical execution chains use obfuscated JavaScript to retrieve an MSI installer, followed by DLL execution through legitimate Windows utilities. Other campaigns use fake software installers or compromised websites displaying counterfeit CAPTCHA prompts that persuade victims to execute clipboard-supplied commands, a technique known as ClickFix. DLL sideloading has also been used in delivery chains.
Latrodectus supports downloading and executing executables, DLLs, and shellcode; collecting and transmitting host information; enumerating files, processes, accounts, domain relationships, network configuration, and installed security software; terminating processes; and updating or removing itself. It has delivered IcedID and Lumma Stealer. Persistence mechanisms include scheduled tasks and startup mechanisms. Its command-and-control communications use encrypted, encoded data over HTTP or HTTPS and support changes to server configuration and beacon timing.
Defense-evasion features include dynamic API resolution, encrypted strings, software packing, binary padding, masquerading, debugger checks, and sandbox checks based on process counts and network-adapter information. Latrodectus can delete its executable while still running by abusing NTFS alternate data streams. Later versions have changed string encryption, communication parameters, and command handlers. The family shares code characteristics, infrastructure, and operational techniques with IcedID.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Latrodectus ...
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a loader primarily used for initial access and payload delivery. It features dynamic command-and-control (C2) configurations, anti-analysis features such as minimum process count and network adapter check, C2 check-in behavior that splits POST data between the Cookie header and POST data.
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
On 20 September 2024, Proofpoint researchers identified a campaign delivering Brute Ratel C4 and Latrodectus.
Latrodectus, also known as IceNova Backdoor ... is a family of malware that has been observed lately in campaigns linked to groups such as Trickbot ( WIZARD SPIDER ) and Conti (and potentially, in Ransomware deliveries), in addition to being attributed to developers from IcedID . Therefore, Latrodectus has been highlighted as a potential threat and is used as a Loader for other malware.
43 distinct techniques documented for this family, organized by ATT&CK tactic.
278 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
109 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader mentionné indirectement dans l’évaluation de liens potentiels entre C2Looper, Oyster et un acteur commun.
A lightweight loader/downloader assessed to be built by the operators behind IcedID. It is delivered via phishing and malicious ads, often masquerades as trusted software, executes as a DLL via rundll32, persists via a COM-created scheduled task, evades sandboxes, and communicates over HTTPS to C2 infrastructure using a distinctive self-signed certificate and /live/ POST path. It serves as an initial-stage intrusion tool and has delivered follow-on payloads including IcedID and Brute Ratel C4; newer builds add a BackConnect (VNC) module.
Double Trouble: Latrodectus and ACR Stealer observed spreading via Google Authenticator Phishing Site
Latrodectus2
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.