Loading malware…
Latrodectus is a Windows malware family primarily characterized as a loader or downloader that also exhibits backdoor-like behavior. First observed in late 2023, it is widely assessed to be linked to the operators behind IcedID and is often treated as a likely successor within that ecosystem. It is used for initial access and payload delivery in financially motivated intrusion activity and has been associated with follow-on deployment of malware such as Lumma Stealer, ACR Stealer, Brute Ratel C4, IcedID, shellcode, and other secondary payloads, including activity linked to ransomware operations.
Latrodectus is commonly distributed through phishing and malspam campaigns, including tax-themed lures, fake document workflows, HTML or PDF attachments, and links that redirect victims to staged JavaScript content. It has also been delivered through watering-hole compromises, malicious advertising, and fake software or security-related installers, including impersonation of trusted brands and update workflows. Observed infection chains frequently use obfuscated JavaScript to retrieve MSI packages, which then execute malicious DLL payloads via rundll32 or MSI mechanisms such as DLL side-loading or in-memory registration paths.
On execution, Latrodectus profiles the host and communicates with command-and-control infrastructure using encrypted and encoded registration data. Reported host data collection includes items such as username, operating system version, MAC address, computer name, domain context, and other system metadata. The malware supports downloading and executing additional payloads, running attacker-supplied commands, terminating processes, enumerating files and processes, and collecting reconnaissance data. Documented command sets include support for executing DLLs, EXEs, shellcode, self-update, self-termination, timeout changes, and other tasking. Newer variants have shown active development, including changes to string obfuscation, command-and-control endpoints, campaign identifiers, and expanded command functionality.
Latrodectus incorporates multiple defense-evasion features. Reported behaviors include anti-analysis checks based on process counts and network adapter characteristics, identification of installed antivirus products, use of custom string encryption, and abuse of NTFS alternate data streams for self-deletion while still running. Persistence has been observed through scheduled tasks, including variants that copy themselves into user-profile locations before establishing recurring execution.
The malware primarily targets Windows environments and has been observed affecting organizations across sectors including financial, automotive, business, engineering, IT, consulting, law, and academia. Because Latrodectus is regularly used as an entry-point malware family by access brokers and loader operators, its presence often indicates a broader intrusion with potential for credential theft, hands-on-keyboard activity, and ransomware enablement.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Threat Details and IOCs Malware: ... Latrodectus ...
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a downloader first discovered by Walmart back in October of 2023... During the Threat Labs hunting activities we discovered a new version of the Latrodectus payload, version 1.4.
Latrodectus is a loader primarily used for initial access and payload delivery. It features dynamic command-and-control (C2) configurations, anti-analysis features such as minimum process count and network adapter check, C2 check-in behavior that splits POST data between the Cookie header and POST data.
2024-03-07 (THURSDAY): LATRODECTUS INFECTION LEADS TO LUMMA STEALER
On 20 September 2024, Proofpoint researchers identified a campaign delivering Brute Ratel C4 and Latrodectus.
Latrodectus, also known as IceNova Backdoor ... is a family of malware that has been observed lately in campaigns linked to groups such as Trickbot ( WIZARD SPIDER ) and Conti (and potentially, in Ransomware deliveries), in addition to being attributed to developers from IcedID . Therefore, Latrodectus has been highlighted as a potential threat and is used as a Loader for other malware.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
the attacker exploited a vulnerable website and injected Javascript to load the malicious C2 domain. The injected Javascript creates an iframe that overlays the original site, with the attacker’s page being displayed within that iframe. | This article will explore how a watering hole attack was employed to spread the Latrodectus Malware.
The attacker usually targets websites with Cross-Origin Resource Sharing (CORS) Vulnerability. In the recent attack vector, the attacker exploited a vulnerable website and injected Javascript
MITRE ATT&CK® Techniques Tactic Technique Procedure Initial Access (TA0001) Phishing (T1566) Phishing website hosted a malicious binary as a legitimate application
The campaign used tax-themed emails that attempted to deliver the red-teaming tool BRc4 and Latrodectus malware... The emails contained a PDF attachment...
Latrodectus 1.9, the malware’s latest evolution first observed in February 2025, reintroduced scheduled tasks for persistence...
Among the several features it contains is the ability to download and execute additional payloads...
The victim initiates the process(cmd.exe), and the process(cmd.exe) spawns the Powershell process. The Powershell process attempts to download the malicious payload(d.txt) from the attacker domain(using curl.exe).
The victim initiates the process(cmd.exe), and the process(cmd.exe) spawns the Powershell process.
After downloading the malicious payload, the powershell process spawns the CScript process and executes the file(d.txt) as a Javascript file.
Execution (TA0002) Native API (T1106) The NtCreateUserProcess() API is used to create a child process
The final payload is a DLL and its DllMain function is called by the crypter code. The next step is the execution of the “AnselEnableCheck” exported function, which is responsible for the execution of the final payload.
The obfuscation technique is employed by adding several comments into the file, making it more difficult to be analyzed as well as increasing the file size considerably.
Defense Evasion(TA0005) Obfuscated Files or Information: Software Packing (T1027.002) Payload is encrypted inside the Resource section
Defense Evasion (TA0005) Obfuscated Files or Information: Dynamic API Resolution (T1027.007) Loads DLLs during runtime
In this command the malware downloads a shellcode from the specified server and executes it via a new thread.
Defense Evasion (TA0005) Indicator Removal: File Deletion (T1070.004) Deletes itself from Temp dir
Once executed/installed, the MSI file uses the rundll32.exe Windows tool to load a DLL named “nvidia.dll” and calls a function named “AnselEnableCheck” exported by this DLL.
The script queries the user agent data from the browser and retrieves the following data: BrowserName BrowserVersion OSName
Command ID Description 2 Collect a list of desktop file names
The information is formatted using a specific pattern, encrypted using the RC4 algorithm, encoded using base64 and sent to the C2.
The script uses Telegram API to send the data to the attacker.
278 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
102 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A lightweight loader/downloader assessed to be built by the operators behind IcedID. It is delivered via phishing and malicious ads, often masquerades as trusted software, executes as a DLL via rundll32, persists via a COM-created scheduled task, evades sandboxes, and communicates over HTTPS to C2 infrastructure using a distinctive self-signed certificate and /live/ POST path. It serves as an initial-stage intrusion tool and has delivered follow-on payloads including IcedID and Brute Ratel C4; newer builds add a BackConnect (VNC) module.
Double Trouble: Latrodectus and ACR Stealer observed spreading via Google Authenticator Phishing Site
Latrodectus2
A named malware/tool appearing in the tooling overlap discussed by IBM, referenced through a Dave-crypted sample and overlap with Tomb-crypted Supper.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.