Latrodectus Use Increased in Campaigns in February and March 2024
Summary
Team Cymru and Proofpoint report that Latrodectus use increased in campaigns in February and March 2024. Their research links the loader to TA577 and TA578 and assesses that IcedID developers likely created it.
Key points
- Latrodectus was first identified in the wild in October 2023 and observed in email campaigns in late November, according to the research.
- After use declined in December 2023 and January 2024, campaign use increased in February and March 2024.
- Proofpoint first observed the loader being distributed by TA577; the research also identifies use by TA578.
- Researchers describe Latrodectus as a new malware family with sandbox-evasion functionality and infrastructure overlap with historic IcedID operations.
- The researchers identified distinct campaign ID patterns indicating threat-actor use in earlier IcedID campaigns.
Article Details
- Event Type
- Threat intelligence research on the Latrodectus malware loader
- Impact
- The research reports increased Latrodectus use in campaigns during February and March 2024 after a decline in December 2023 and January 2024. It was first observed in Proofpoint data being distributed by TA577 and was also used by at least one other threat actor, TA578. The researchers assess that IcedID developers likely created Latrodectus and that financially motivated threat actors, particularly those that previously distributed IcedID, may use it increasingly.
Threat Actors
Malware
IcedIDWhilst it shares some similarities to IcedID, Latrodectus is assessed to be a wholly new malware family, and our joint analysis indicates the IcedID developers likely created it.LatrodectusFor this research, we partnered with Proofpoint’s Threat Research team in a collaborative effort to provide a comprehensive overview of the Latrodectus loader malware.