Loading story…
Cybersecurity researchers have identified a new malware family named YiBackdoor, which exhibits significant code similarities with the IcedID and Latrodectus malware strains. YiBackdoor is capable of executing arbitrary commands, collecting system information, capturing screenshots, and deploying plugins to expand its functionality. The malware employs anti-analysis techniques, injects itself into the svchost.exe process, and achieves persistence via the Windows Run registry key. Initial analysis suggests that YiBackdoor may be developed by the same actors behind IcedID and Latrodectus and could be used in conjunction with these loaders to facilitate initial access for ransomware attacks. Limited deployments indicate that YiBackdoor is either under development or in a testing phase.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Follow-on reporting noted that researchers were also analyzing novel YiBackdoor samples in the context of newly emerging ZLoader versions. This represented an additional technical development in the broader malware ecosystem discussion.
Analysis found major code similarities between YiBackdoor and the IcedID and Latrodectus malware families, suggesting a development or operational relationship. Multiple outlets reported this linkage as a key technical finding.
Security researchers reported a newly identified malware family named YiBackdoor. The reporting emerged in late September 2025 and described it as a distinct backdoor under active analysis.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **Latrodectus**, a Windows downloader increasingly tied to email and phishing campaigns, has expanded across multiple infection chains while showing strong links to **IcedID** through code similarities, shared infrastructure, and overlapping tradecraft. Threat actors including **TA577** and **TA578** have distributed it through obfuscated JavaScript, MSI installers, DLLs, ISO and LNK files, WebDAV-hosted payloads, and phishing lures such as fake Google Authenticator downloads; one campaign also paired Latrodectus with **ACR Stealer**, while another analysis found **Brute Ratel C4 Badger** used to load the malware. Typical execution flows use JavaScript to invoke `msiexec.exe`, install a remote MSI, and launch a malicious DLL with `rundll32.exe`, often via the exported function `AnselEnableCheck`. Recent analyses show Latrodectus evolving rapidly as a lightweight loader focused on reconnaissance, persistence, and payload delivery. Newer variants replaced earlier XOR-based string deobfuscation with **AES-256 CTR**, changed campaign ID inputs, updated RC4-based C2 communications, and switched HTTP endpoints from `/live` to `/test`, while adding commands to download and execute shellcode and to write files into `%AppData%`. The malware also uses anti-analysis checks, scheduled-task persistence, runtime API resolution, and encrypted command traffic, and it retains functionality to fetch IcedID components even when those payloads were not observed. Researchers said the pace of infrastructure turnover and feature changes indicates active development and continued use in financially motivated intrusion campaigns.
Aug 15, 2026
Researchers and incident responders detailed how **IcedID** (also known as **BokBot**) evolved from a banking trojan into a broader access malware platform that supports **BackConnect** command-and-control, **SOCKS proxying**, **VNC/DarkVNC**, reverse shell access, file management, and follow-on payload delivery including **Cobalt Strike**. Protocol analysis showed a compact BackConnect packet format with changing authentication values and commands that can spawn secondary sessions for remote control and proxy activity, while malware reverse engineering documented persistence through scheduled tasks, injected `svchost.exe` processes, encrypted configuration retrieval over HTTPS, browser traffic interception, and credential theft through local proxy and web-injection components. Network telemetry and case studies showed operators using this capability for post-compromise reconnaissance, Active Directory enumeration, disk listing, internal scanning, proxied outbound TLS traffic, and likely spam operations over TCP/465 and TCP/587. Team Cymru reported that IcedID’s BackConnect ecosystem grew from 11 observed C2 servers in mid-2022 to 34 medium- and high-confidence servers in the first half of 2023, with server lifetimes shrinking from about four weeks to roughly eight days and management infrastructure spanning multiple countries. Separate infection chains tied IcedID delivery to **TA551/Shathak** malspam and other loaders, with victims receiving password-protected ZIP, ISO, JavaScript, or macro-laden documents that ultimately installed IcedID before attackers deployed remote access tooling and, in some cases, **Cobalt Strike** as a precursor to broader intrusion activity and possible ransomware.
Aug 15, 2026
Researchers reported that **IcedID** (also known as **BokBot**) continued to evolve from a banking trojan into a multi-stage malware platform widely used to establish initial access for ransomware intrusions. Across observed campaigns, phishing emails delivered password-protected ZIP archives, malicious Word or Excel documents, or zipped JavaScript files that launched HTA scripts and DLL loaders through tools such as `rundll32`, `regsvr32`, and `mshta.exe`. Analysts documented several loader techniques, including disguised DLLs saved with `.jpg` extensions, registry-stored configuration data derived from victim-specific bot IDs, and even PNG steganography used to hide encrypted shellcode. Later reporting also described PhotoLoader and GzipLoader variants, including a newer GzipLoader build that added dynamic API resolution and XOR-based stacked-string encryption while dropping earlier SSL-pinning behavior, changes that risked breaking older pattern-based detections. Incident responders and threat researchers linked IcedID infections to financially motivated intrusion clusters that rapidly escalated to **MAZE** and later **EGREGOR** ransomware. Mandiant said UNC2198 repeatedly leveraged access originating from the MOUSEISLAND → PHOTOLOADER → ICEDID chain, then deployed tooling including **SYSTEMBC**, **WINDARC**, **Cobalt Strike BEACON**, **METERPRETER**, **KOADIC**, and **PowerShell EMPIRE** for discovery, lateral movement, and privilege escalation, including observed abuse of `CVE-2020-0787`. In multiple cases, attackers used **BloodHound**, moved laterally over WinRM and RDP, exfiltrated data with **RCLONE**, and encrypted victim environments within days. Defenders published YARA rules, unpacking workflows using **Qiling**, registry- and network-based hunting methods, and configuration extractors to recover domains, campaign IDs, and other indicators from packed IcedID samples.
Aug 15, 2026