Latrodectus

Latrodectus, a harmful malware discovered in late 2023, has been gaining momentum among threat actors, with a significant increase in activity noted throughout February and March. This malicious software is being employed by initial access brokers (IABs) in email threat campaigns and uses MSI files to execute payloads, a technique also adopted by adversaries such as DarkGate. Researchers from Proofpoint and Team Cymru S2 Threat Research Team predict that Latrodectus will continue to gain traction due to its effective sandbox evasion techniques, which hinder researchers and defenders' efforts to analyze samples. Although initially thought to be a variant of the well-known IcedID malware, further analysis revealed that Latrodectus is a distinct entity. However, it shares similar characteristics with IcedID, leading researchers to conclude that both were likely created by the same developers. The malware, named after a string of code found during analysis, has been used in campaigns hosted on domains such as peronikilinfer[.]com and jkbarmossen[.]com, serving as Command and Control servers (C2s) for both IcedID and Latrodectus. This indicates a shared resource pool across these malware families. The recent campaign by LUNAR SPIDER utilized Latrodectus, a heavily obfuscated JavaScript loader, to deliver Brute Ratel C4 payloads targeting the financial sector. Indicators of compromise (IoCs) related to Latrodectus have been identified and aggregated on the Pulsedive platform, providing valuable data for ongoing cybersecurity efforts. To counteract this threat, it is recommended to continue user awareness training since Latrodectus requires user execution. In conclusion, Latrodectus is a relatively new loader that has been observed within the threat landscape and leveraged by multiple threat actors.