Latrodectus

Latrodectus, a new type of malware discovered in late 2023, is being used by Initial Access Brokers (IABs) in email threat campaigns. Initially mistaken for a variant of the well-known IcedID malware due to similar characteristics, researchers at Proofpoint and Team Cymru S2 Threat Research Team have determined that Latrodectus is a distinct entity, likely developed by the same creators as IcedID. Throughout February and March 2024, there was a significant increase in threat activity using this new loader, leading experts to predict that its use will continue to rise among threat actors. The malware operates through sophisticated sandbox evasion techniques, which can delay researchers and defenders from analyzing its samples. It has been named "Latrodectus" based on a string of code found during analysis. On February 9th, 22nd, and 23rd of 2024, data dumps were reported from contact form campaigns involving Latrodectus. The malware utilizes command and control servers (C2s) to send HTTP requests instructing it to execute files, collect system information, or terminate its own processes. Multiple indicators of compromise (IoCs) have been identified, including numerous URLs associated with the malware's activities. To mitigate the risks posed by Latrodectus, continued user awareness training is recommended as the malware requires user execution. As a newer loader within the threat landscape, Latrodectus has been leveraged by multiple threat actors and employs various anti-analysis techniques, such as checking the operating system version and the number of running processes. Its capabilities include collecting system information, executing files, and terminating its own processes.