Ankura CTIX FLASH Update - May 21, 2024

Latrodectus on the Rise: The New IcedID?

For the past few months, researchers at Elastic Security have observed an uptick in the volume of email phishing campaigns involving Latrodectus malware. First discovered by researchers around the Fall of 2023, Latrodectus is a malware loader that shares infrastructure overlap with the IcedID malware family. IcedID has been a very popular malware family introduced in 2017 as a banking trojan that also functions as a loader for other malware, including ransomware. Researchers believe Latrodectus is written by the same developers as IcedID based on the malware's functionality and the attributed threat actor groups that have been deploying it. In addition, Latrodectus itself has a command handler that specifically downloads and executes an IcedID payload. Researchers speculate this IcedID command handler could exist as a backup malware deployment in the case that Latrodectus does not perform as expected. The main function of