Latrodectus: The Black Widow Loader Quietly Replacing IcedID

Background

Latrodectus first appeared in late 2023 and was publicly detailed in April 2024 by Proofpoint and Team Cymru. The name is the scientific genus of the black widow spider, and the malware is tracked under several aliases (BlackWidow, IceNova, Unidentified 111). Analysts link its development to the operators behind IcedID (the LUNAR SPIDER ecosystem) and its distribution to financially motivated initial-access brokers. Functionally it is a lean loader: small footprint, strong obfuscation, and a command set focused on reconnaissance and delivering the next stage rather than doing damage itself.

A note on the name, because three unrelated things share it. This report is about the Latrodectus malware loader. It is not the same as the 2016 AMX audiovisual-control hardware backdoor also nicknamed ‘Black Widow’, a hidden administrative account with full-admin and packet-capture capability disclosed by researchers in devices used by high-profile government and military customers and later patched by the vendor, and it is not the Black Widow movie-themed piracy and giveaway scams that circulated as social-engineering lures. Different threats, same spider.

Latrodectus is delivered mostly through email phishing and malicious advertising, often with convincing lures such as fake tax forms, fake browser or security updates, and cloned brand pages. A recurring theme is impersonation of trusted software to blend in: one sample posed as AhnLab Smart Defense (MeDExt.dll), another as Google Authenticator (GoogleAuthSetup), and a campaign impersonated Google Safety Centre. The typical chain runs from a script or MSI to a DLL that is launched with rundll32, after which the loader registers the victim to its C2 and pulls down whatever the operator wants to run next.

Once running, Latrodectus enumerates the host and posts an encrypted registration to its C2 over HTTPS, commonly to a /live/ URI path. Its servers repeatedly reuse a self-signed TLS certificate (Subject CN localhost, Organization ‘Internet Widgits Pty Ltd’, country AU) and tend to expose ports 443 and 8080, which, together with a shared JA4X certificate fingerprint, lets defenders pivot from one server to the wider cluster. Persistence is achieved by using Windows COM to create a scheduled task, and the code is wrapped in custom string encryption that has driven a small industry of public deobfuscation and unpacking tooling.

What we observed

How a Latrodectus infection unfolds, stage by stage:

• Impersonation is the entry trick: unsigned DLLs are renamed to look like trusted security or utility software (AhnLab, Google Authenticator), increasing the odds of bypassing scrutiny, always treat renamed or unsigned DLLs of security products as suspect.
• Executes as a DLL via rundll32: the loader runs as a library through a living-off-the-land binary rather than a standalone EXE, reducing obvious process artefacts.
• Sandbox-aware: it checks the number of running processes and whether the host has a valid MAC address to detect analysis environments before doing anything interesting.
• Heavy obfuscation: custom string-encryption routines hide its configuration and behaviour from static analysis, which is why detection should lean on behaviour and network fingerprints, not strings.
• Distinctive C2 fingerprint: a self-signed certificate (CN localhost, O ‘Internet Widgits Pty Ltd’), ports 443 and 8080, and a POST to a /live/ path form a durable behavioural signature even as domains rotate.
• Persistence via COM scheduled task: the loader uses the Windows Component Object Model to register a scheduled task, a quieter route than direct schtasks.
• It is a launchpad, not the payload: Latrodectus has delivered IcedID and Brute Ratel C4, and newer builds add a BackConnect (VNC) module for hands-on-keyboard access, so a detection is an early warning of a larger intrusion.

Latrodectus infection chain

The loader itself does little damage. Its job is to survive review, phone home, and deliver the real payload, so break the chain before the last box.

Attribution

Latrodectus is financially motivated cybercrime tooling, not nation-state. Multiple vendors (Proofpoint, Team Cymru, Elastic, Symantec, Rapid7) assess it as developed by the IcedID operators and distributed by initial-access brokers, positioning it as a successor or replacement for IcedID in the loader market. Confidence in the tooling, delivery and infrastructure is high and drawn from that corroborating reporting. The indicators below are real observables from public analysis; because the operators rotate domains and IPs frequently, prioritise the behavioural and certificate fingerprints over any single static IOC.

Confidence: 90%.

When IcedID went quiet, Latrodectus filled the gap, a lighter loader from the same web, built to quietly drop whatever comes next.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

One Latrodectus C2 cluster at a glance

A single certificate-and-path fingerprint (self-signed ‘localhost’, ports 443/8080, POST /live/) tied this cluster together across hosts.

Indicators of compromise

Defenders can block or hunt the following:

Latrodectus C2 infrastructure cluster

Detection

Copy-ready hunting query:

# Latrodectus (Black Widow) hunt: certificate + path fingerprint beats rotating domains
# 1) The durable network fingerprint (self-signed cert + /live/ POST + dual ports)
index=proxy OR index=tls (uri_path="*/live/" http_method=POST) OR (ssl_subject="*CN=localhost*" ssl_issuer_org="Internet Widgits Pty Ltd") OR (dest_port IN (443,8080) ja4x="96a6439c8f5c_96a6439c8f5c_795797892f9c")
# 2) rundll32 running a DLL from user-writable paths (loader execution)
index=edr process_name="rundll32.exe" (command_line="*\\AppData\\*" OR command_line="*\\Temp\\*") command_line="*.dll*"
# 3) DLLs masquerading as security/utility software
index=edr file_name IN ("MeDExt.dll","GoogleAuthSetup*") signed=false
# 4) COM-created scheduled task shortly after a DLL loads (persistence)
index=edr event="scheduled_task_create" parent_process IN ("rundll32.exe","msiexec.exe")
# 5) Known indicators (expect rotation -- prioritise #1 over these)
index=proxy domain IN ("stripplasst.com","coolarition.com","riscoarchez.com","spikeliftall.com","worlpquano.com","godfaetret.com","carflotyup.com")
index=edr sha256 IN ("23546ec67474ed6788a14c9410f3fc458b5c5ff8bd13885100fb4f3e930a30bf","62536e1486be7e31df6c111ed96777b9e3f2a912a2d7111253ae6a5519e71830","a459ce4bfb5d649410231bd4776c194b0891c8c5328bafc22184fe3111c0b3e7")

Recommendations

• Hunt the fingerprint, not just the domains: the self-signed localhost certificate, the JA4X hash, ports 443/8080 and the POST /live/ path persist even as domains rotate, so build detections on those first.
• Scrutinise renamed and unsigned DLLs: alert on files impersonating security or utility software (AhnLab, Google Authenticator) and on rundll32 executing DLLs from Temp or AppData with unusual exports.
• Break the delivery chain: harden email against fake-form and fake-update lures, and use attack-surface-reduction rules to block script and MSI chains that spawn rundll32.
• Alert on COM-created scheduled tasks: a scheduled task registered right after a DLL loads via rundll32 or msiexec is a strong Latrodectus persistence signal.
• Treat any hit as an active intrusion: Latrodectus is a first stage that has dropped IcedID and Brute Ratel C4, so on detection, isolate, hunt for follow-on payloads and BackConnect (VNC) activity, and assume hands-on-keyboard operators.
• Lean on behavioural EDR over static signatures: heavy string obfuscation defeats string-based rules, so prioritise process-lineage, network-fingerprint and persistence-behaviour detections, and feed the IOCs into your SIEM and TIP with an expectation of churn.