Loading malware…
Latrodectus, also known as IceNova and BlackWidow, is a Windows loader/downloader with backdoor-like command execution and host-profiling functions. First identified in late 2023, it is used in financially motivated intrusion campaigns as an initial-access and payload-delivery mechanism, including delivery of IcedID, Lumma Stealer, Brute Ratel C4, and other follow-on malware. Multiple researchers assess that it is linked to, or developed by, the IcedID/LUNAR SPIDER ecosystem, although the precise organizational relationship is not definitively established.
Latrodectus is commonly delivered through phishing and malspam campaigns, including malicious HTML, PDF, and JavaScript lures, as well as fake software installers, malicious advertising, watering-hole compromises, and ClickFix-style social engineering. Delivery chains often use scripts and MSI packages to execute a malicious DLL with Windows utilities; some campaigns use DLL side-loading. Targets have included financial, automotive, business, engineering, IT, consulting, and U.S. tax-related recipients.
The malware collects host and campaign information, including operating-system details, user and host identity data, network-adapter information, domain context, running processes, desktop files, and installed security products. It can execute attacker commands; download and run PE files, DLLs, shellcode, and additional malware; adjust its beaconing behavior; update or terminate itself; and terminate processes. It uses encrypted and encoded command-and-control communications over HTTP or HTTPS, depending on the version.
Latrodectus incorporates substantial evasion functionality, including runtime API resolution, encrypted strings, debugger and sandbox checks, process-count and network-adapter validation, and self-deletion through NTFS alternate data streams. It can establish persistence through a COM-created scheduled task, with observed configurations ranging from execution at user logon to periodic task execution. Later variants have evolved their string encryption, command set, command-and-control protocol, and payload-delivery features, including in-memory shellcode execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Latrodectus ...
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a loader primarily used for initial access and payload delivery. It features dynamic command-and-control (C2) configurations, anti-analysis features such as minimum process count and network adapter check, C2 check-in behavior that splits POST data between the Cookie header and POST data.
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
On 20 September 2024, Proofpoint researchers identified a campaign delivering Brute Ratel C4 and Latrodectus.
Latrodectus, also known as IceNova Backdoor ... is a family of malware that has been observed lately in campaigns linked to groups such as Trickbot ( WIZARD SPIDER ) and Conti (and potentially, in Ransomware deliveries), in addition to being attributed to developers from IcedID . Therefore, Latrodectus has been highlighted as a potential threat and is used as a Loader for other malware.
39 distinct techniques documented for this family, organized by ATT&CK tactic.
the attacker exploited a vulnerable website and injected Javascript to load the malicious C2 domain. The injected Javascript creates an iframe that overlays the original site, with the attacker’s page being displayed within that iframe. | This article will explore how a watering hole attack was employed to spread the Latrodectus Malware.
The attacker usually targets websites with Cross-Origin Resource Sharing (CORS) Vulnerability. In the recent attack vector, the attacker exploited a vulnerable website and injected Javascript
MITRE ATT&CK® Techniques Tactic Technique Procedure Initial Access (TA0001) Phishing (T1566) Phishing website hosted a malicious binary as a legitimate application
Elastic Security Labs observed an increase in email campaigns delivering LATRODECTUS... involving oversized JavaScript files.
Javascript dropper invokes WMI to mount a WEBDAV share and invokes msiexec to install a remote msi file.
LATRODECTUS sets up a scheduled task for persistence using the Windows Component Object Model (COM)... scheduled to execute upon successful logon.
The victim initiates the process(cmd.exe), and the process(cmd.exe) spawns the Powershell process. The Powershell process attempts to download the malicious payload(d.txt) from the attacker domain(using curl.exe).
LATRODECTUS Command ID (4) - Collect system information via a series of cmd.exe execution.
After downloading the malicious payload, the powershell process spawns the CScript process and executes the file(d.txt) as a Javascript file.
The final payload is a DLL and its DllMain function is called by the crypter code. The next step is the execution of the “AnselEnableCheck” exported function, which is responsible for the execution of the final payload.
LATRODECTUS is delivered via oversized Javascript files, on average more than 800KB filled with random text. All of the strings within LATRODECTUS are protected using a straightforward algorithm.
Defense Evasion(TA0005) Obfuscated Files or Information: Software Packing (T1027.002) Payload is encrypted inside the Resource section
LATRODECTUS obfuscates the majority of its imports until runtime... using a CRC32 checksum to resolve kernel32.dll and ntdll.dll modules and their functions.
Our LATRODECTUS sample comes initially packed with file information masquerading as a component to Bitdefender’s kernel-mode driver (TRUFOS.SYS).
Rundll32 loads the LATRODECTUS DLL from AppData and starts code injection. Shellcode execution triggers endpoint behavior alerts and a memory threat detection alert.
The technique allows LATRODECTUS to delete itself while the process is still running using an alternate data stream.
This command handler downloads a DLL from C2 server, writes it to disk with a randomly generated file name, and executes the DLL using rundll32.exe.
In order to avoid sandboxes or virtual machines that may have a low number of active processes, two validation checks are used to combine the number of running processes with the OS product version.
C:\Windows\System32\cmd.exe /c net view /all /domain [and] net view /all
It collects the entire running process ancestry from the infected machine via the CreateToolhelp32Snapshot API.
This command handler creates a new thread that runs... ipconfig /all [and] systeminfo.
This command handler will retrieve a list of the contents of the user’s desktop.
C:\Windows\System32\cmd.exe /c nltest /domain_trusts [and] nltest /domain_trusts /all_trusts
In order to avoid sandboxes or virtual machines that may have a low number of active processes, two validation checks are used to combine the number of running processes with the OS product version.
The information is formatted using a specific pattern, encrypted using the RC4 algorithm, encoded using base64 and sent to the C2.
The script uses Telegram API to send the data to the attacker.
The first POST request over HTTPS... register[s] the infected system.
278 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
106 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader mentionné indirectement dans l’évaluation de liens potentiels entre C2Looper, Oyster et un acteur commun.
A lightweight loader/downloader assessed to be built by the operators behind IcedID. It is delivered via phishing and malicious ads, often masquerades as trusted software, executes as a DLL via rundll32, persists via a COM-created scheduled task, evades sandboxes, and communicates over HTTPS to C2 infrastructure using a distinctive self-signed certificate and /live/ POST path. It serves as an initial-stage intrusion tool and has delivered follow-on payloads including IcedID and Brute Ratel C4; newer builds add a BackConnect (VNC) module.
Double Trouble: Latrodectus and ACR Stealer observed spreading via Google Authenticator Phishing Site
Latrodectus2
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.