For the past few months, researchers at Elastic Security have observed an uptick in the volume of email phishing campaigns involving Latrodectus malware. First discovered by researchers around the Fall of 2023, Latrodectus is a malware loader that shares infrastructure overlap with the IcedID malware family. IcedID has been a very popular malware family introduced in 2017 as a banking trojan that also functions as a loader for other malware, including ransomware. Researchers believe Latrodectus is written by the same developers as IcedID based on the malware’s functionality and the attributed threat actor groups that have been deploying it. In addition, Latrodectus itself has a command handler that specifically downloads and executes an IcedID payload. Researchers speculate this IcedID command handler could exist as a backup malware deployment in the case that Latrodectus does not perform as expected. The main function of Latrodectus is to create a foothold in the victim’s machine and a connection to back to the threat actor’s command-and-control (C2) server to facilitate the deployment of additional malware. The Latrodectus malware masquerades as libraries associated with legitimate software and self-deletes running files to evade detection. The most recent version of Latrodectus observed in the recent uptick of phishing campaigns can now enumerate files in the desktop directory and retrieve the entire running process hierarchy from the victim machine. The malware campaign associated with Latrodectus begins with a JavaScript dropper that leverages WMI to install an MSI file via msiexec.exe. The MSI file is remotely hosted on a WebDAV share and deploys the Latrodectus payload on execution. CTIX analysts recommend that organizations become familiar with the IOCs associated with this malware as it has the potential to become more widely used. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.