Ankura CTIX FLASH Update - April 9, 2024

Ransomware/Malware Activity

Threat Actors Use Latrodectus Malware in Phishing Campaign

The malware known as Latrodectus, emerging in email phishing campaigns since late November 2023, represents a sophisticated evolution in the cyber threat landscape, closely related to the previously identified IcedID loader. Discovered and analyzed by researchers from Proofpoint and Team Cymru, Latrodectus exhibits advanced sandbox evasion capabilities and is designed to download and execute arbitrary commands, marking it as a dynamic and formidable downloader. It appears to be the brainchild of the same threat actors behind IcedID, aimed at facilitating the deployment of additional malware through initial access brokers, notably TA577 and TA578. These campaigns cleverly leverage spoofed legal threat communications to distribute a JavaScript file, which subsequently deploys the Latrodectus payload. This malware verifies its operating environment by checking for a valid MAC