MITRE ATT&CKsoftware (malware)
S1160 Latrodectus
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- IceNova, Unidentified 111
- Version
- 1.0
- Created
- 2024-09-16
Description
Latrodectus is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. Latrodectus has most often been distributed through email campaigns, primarily by TA577 and TA578, and has infrastructure overlaps with historic IcedID operations.
Related
Uses · MITRE ATT&CK (43)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.007 Dynamic API Resolution sub-technique
- T1622 Debugger Evasion technique
- T1059.007 JavaScript sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1564.004 NTFS File Attributes sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.001 System Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.002 Domain Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1559.001 Component Object Model sub-technique
- T1021.005 VNC sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.001 Binary Padding sub-technique
- T1027.002 Software Packing sub-technique
- T1070.004 File Deletion sub-technique
- T1218.007 Msiexec sub-technique
- T1218.011 Rundll32 sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.005 Scheduled Task sub-technique
- T1529 System Shutdown/Reboot technique
- T1482 Domain Trust Discovery technique
- T1135 Network Share Discovery technique
References
- https://www.bleepingcomputer.com/news/security/new-latrodectus-malware-attacks-use-microsoft-cloudflare-themes/ Bleeping Computer Latrodectus April 2024
- https://www.bitsight.com/blog/latrodectus-are-you-coming-back Bitsight Latrodectus June 2024
- https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice Latrodectus APR 2024