Loading malware…
Latrodectus is a Windows malware family primarily characterized as a loader or downloader that also exhibits backdoor-like behavior. First observed in late 2023, it is widely assessed to be part of the IcedID ecosystem or developed by operators associated with IcedID, and it has been used by financially motivated intrusion actors and initial-access brokers as a payload-delivery platform for follow-on compromise. Reported aliases include IceNova and BlackWidow.
Latrodectus is commonly delivered through phishing and malspam campaigns, including tax-themed lures, fake document workflows, and malicious JavaScript or MSI-based infection chains. It has also been observed in watering-hole activity using fake verification pages and clipboard-based social engineering, as well as phishing sites impersonating trusted brands such as Google Authenticator or Google Safety Centre. Some campaigns have likely leveraged malvertising to drive victims to these lures.
Operationally, Latrodectus profiles infected hosts, collects system information, communicates with command-and-control infrastructure, and downloads and executes additional payloads. Documented follow-on payloads include Lumma Stealer, Brute Ratel C4, IcedID, and other malware associated with broader hands-on intrusions and ransomware operations. Reported functionality includes command execution, process termination, desktop and process enumeration, system reconnaissance, and staged payload retrieval. Newer variants have added shellcode delivery and execution capabilities and file download functions, reflecting active development.
The malware uses multiple defense-evasion and execution techniques. Observed samples employ obfuscated JavaScript stages, MSI installers, DLL execution through rundll32, crypter-protected payloads including use of the Dave crypter, encrypted or obfuscated strings, anti-analysis checks such as process-count and network-adapter validation, and scheduled-task persistence in some versions. Latrodectus has also been noted as capable of identifying installed antivirus products and of deleting itself while still running through abuse of NTFS alternate data streams.
Latrodectus infections have been associated with campaigns targeting financial, automotive, business, engineering, IT, consulting, and other enterprise sectors, with substantial activity against organizations and users in the United States. Because it is frequently used as an initial-access and payload-delivery mechanism, detection of Latrodectus often indicates elevated risk of subsequent credential theft, interactive post-exploitation, or ransomware deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Latrodectus ...
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a loader primarily used for initial access and payload delivery. It features dynamic command-and-control (C2) configurations, anti-analysis features such as minimum process count and network adapter check, C2 check-in behavior that splits POST data between the Cookie header and POST data.
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
On 20 September 2024, Proofpoint researchers identified a campaign delivering Brute Ratel C4 and Latrodectus.
Latrodectus, also known as IceNova Backdoor ... is a family of malware that has been observed lately in campaigns linked to groups such as Trickbot ( WIZARD SPIDER ) and Conti (and potentially, in Ransomware deliveries), in addition to being attributed to developers from IcedID . Therefore, Latrodectus has been highlighted as a potential threat and is used as a Loader for other malware.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
the attacker exploited a vulnerable website and injected Javascript to load the malicious C2 domain. The injected Javascript creates an iframe that overlays the original site, with the attacker’s page being displayed within that iframe. | This article will explore how a watering hole attack was employed to spread the Latrodectus Malware.
The attacker usually targets websites with Cross-Origin Resource Sharing (CORS) Vulnerability. In the recent attack vector, the attacker exploited a vulnerable website and injected Javascript
MITRE ATT&CK® Techniques Tactic Technique Procedure Initial Access (TA0001) Phishing (T1566) Phishing website hosted a malicious binary as a legitimate application
The campaign used tax-themed emails that attempted to deliver the red-teaming tool BRc4 and Latrodectus malware... The emails contained a PDF attachment...
Latrodectus 1.9, the malware’s latest evolution first observed in February 2025, reintroduced scheduled tasks for persistence...
Among the several features it contains is the ability to download and execute additional payloads...
The victim initiates the process(cmd.exe), and the process(cmd.exe) spawns the Powershell process. The Powershell process attempts to download the malicious payload(d.txt) from the attacker domain(using curl.exe).
The victim initiates the process(cmd.exe), and the process(cmd.exe) spawns the Powershell process.
After downloading the malicious payload, the powershell process spawns the CScript process and executes the file(d.txt) as a Javascript file.
Execution (TA0002) Native API (T1106) The NtCreateUserProcess() API is used to create a child process
The final payload is a DLL and its DllMain function is called by the crypter code. The next step is the execution of the “AnselEnableCheck” exported function, which is responsible for the execution of the final payload.
The obfuscation technique is employed by adding several comments into the file, making it more difficult to be analyzed as well as increasing the file size considerably.
Defense Evasion(TA0005) Obfuscated Files or Information: Software Packing (T1027.002) Payload is encrypted inside the Resource section
Defense Evasion (TA0005) Obfuscated Files or Information: Dynamic API Resolution (T1027.007) Loads DLLs during runtime
In this command the malware downloads a shellcode from the specified server and executes it via a new thread.
Defense Evasion (TA0005) Indicator Removal: File Deletion (T1070.004) Deletes itself from Temp dir
Once executed/installed, the MSI file uses the rundll32.exe Windows tool to load a DLL named “nvidia.dll” and calls a function named “AnselEnableCheck” exported by this DLL.
The script queries the user agent data from the browser and retrieves the following data: BrowserName BrowserVersion OSName
Command ID Description 2 Collect a list of desktop file names
The information is formatted using a specific pattern, encrypted using the RC4 algorithm, encoded using base64 and sent to the C2.
The script uses Telegram API to send the data to the attacker.
278 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
103 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Loader mentionné indirectement dans l’évaluation de liens potentiels entre C2Looper, Oyster et un acteur commun.
A lightweight loader/downloader assessed to be built by the operators behind IcedID. It is delivered via phishing and malicious ads, often masquerades as trusted software, executes as a DLL via rundll32, persists via a COM-created scheduled task, evades sandboxes, and communicates over HTTPS to C2 infrastructure using a distinctive self-signed certificate and /live/ POST path. It serves as an initial-stage intrusion tool and has delivered follow-on payloads including IcedID and Brute Ratel C4; newer builds add a BackConnect (VNC) module.
Double Trouble: Latrodectus and ACR Stealer observed spreading via Google Authenticator Phishing Site
Latrodectus2
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.