APT / THREAT GROUP

Latrodectus

aliases

Last seen:Mar 17, 2026

Intelligence Profile

First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.

Threat Analysis

Latrodectus is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://0x0d4y.blog/case-study-analyzing-and-implementing-string-decryption-algorithms-latrodectus/

→https://0x0d4y.blog/latrodectus-technical-analysis-of-the-new-icedid/

→https://any.run/malware-trends/latrodectus

→https://blog.eclecticiq.com/inside-intelligence-center-lunar-spider-enabling-ransomware-attacks-on-financial-sector-with-brute-ratel-c4-and-latrodectus

→https://blog.krakz.fr/articles/latrodectus/

Quick Facts

TypeAPT / Threat Group

Aliases5

Also Known As

IceNovaLatrodectusBLACKWIDOWwin.latrodectusLotus

External Intelligence

Malpedia: win.latrodectus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Latrodectus