Skip to content
Latrodectus Malware: New Windows Loader Threat Discovered

Latrodectus Malware: New Windows Loader Threat Discovered

First seen 25 Oct 2026, 12:42 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 25, 2026 at 15:14 UTC

Latrodectus, also known as BlackWidow and IceNova, is a Windows malware loader identified in October 2023. It acts as a backdoor, enabling attackers to download and execute additional malicious payloads. This malware primarily spreads through email campaigns and is linked to the LUNAR SPIDER group, known for developing IcedID. It communicates with its command and control server using RC4 encrypted HTTP requests. The malware can execute commands to gather information from the infected machine and establish persistence. Key threat actor groups associated with its distribution include TA577 and TA578. Current reports indicate it remains active and poses a significant risk to Windows systems. Security experts recommend vigilance against phishing attempts as a primary mitigation strategy.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2023-10-01
Latrodectus malware first discovered
Researchers at Walmart identified Latrodectus while investigating IcedID. It was noted for its ability to download further payloads.
2-Spyware
2024-05-01
Latrodectus identified as IcedID replacement
Elastic Security Labs reported that Latrodectus could be a potential replacement for IcedID, indicating its evolving threat.
2-Spyware
2025-04-01
Storm-0249 linked to Latrodectus
Malpedia connected the actor Storm-0249 to Latrodectus through a Microsoft Threat Intelligence report on tax-themed phishing.
2-Spyware

More articles in this cluster (5)

Following this threat?

Track Lunar Spider and IcedID in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (19)

1 / 3

Common questions

What systems are affected by Latrodectus?
Latrodectus primarily targets Windows operating systems as a malware loader.
How does Latrodectus spread?
It mainly spreads through email campaigns, often disguised in phishing attempts.
What should organizations do to protect against Latrodectus?
Organizations should enhance email security measures and train employees to recognize phishing attempts.