Latrodectus Loader: Three-Stage JScript/VBScript Obfuscation Delivers WMI/msiexec MSI Payload (sokingscrosshotel[.]com)
Latrodectus Loader (TL-2026-1486), also tracked as BlackWidow, is a medium-severity malware campaign, first published 2026-07-18. It is attributed to TA578 - G1038 with medium confidence, affects Microsoft Windows (wscript.exe/cscript.exe, WMI, msiexec.exe, maps to 43 MITRE ATT&CK techniques (T1005, T1016, T1021.005), and is covered by 9 detection rules and 31 indicators of compromise.
Key facts for TL-2026-1486
- Threat ID
- TL-2026-1486
- Also known as
- BlackWidow, IceNova, Lotus, Unidentified 111
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-18
- Last reviewed
- 2026-07-18
- Attribution
- TA578 - G1038
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- finance, technology, manufacturing, government administration, professional-services, retail
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Latrodectus Loader
Malware and tooling: DarkGate - S1111, IcedID, Latrodectus - S1160, Pikabot - S1145, QakBot
Embee Research dissected a Latrodectus downloader delivered as a heavily obfuscated 845KB JScript file using junk-comment padding and self-referencing (comment-embedded) code to conceal a second-stage VBScript. The VBScript maps a network drive to the malicious domain sokingscrosshotel[.]com and uses WMI to spawn msiexec.exe, silently installing a remotely hosted MSI (upd.msi) before tearing down the drive mapping to reduce forensic footprint.
How Latrodectus Loader works
Latrodectus (aka BlackWidow, IceNova, Lotus, Unidentified 111, and tracked by MITRE as S1160) is a Windows malware loader first observed in November 2023 and assessed with high confidence to have been built by former IcedID developers based on shared code lineage, infrastructure overlap, and identical operator jumpboxes. It rose to prominence through 2024 as a functional successor to IcedID, deployed primarily by TA577 (initial distributor, November 2023) and TA578 (primary operator from mid-January 2024 onward, previously associated with IcedID and Bumblebee).
This sample, analyzed by Embee Research and uploaded to MalwareBazaar by researcher pr0xylife, demonstrates a distinctive three-stage JScript/VBScript delivery chain built specifically to defeat static analysis and automated sandboxing:
Stage 1 — a JScript file inflated from a functional ~37 lines to 1,890 total lines (845KB on disk) via thousands of `//`-prefixed junk comment lines generated from a wordlist. This bulk both evades size-based heuristics and overwhelms manual review.
Stage 2 — after junk-comment lines are filtered out, the remaining ~37 lines of legitimate JScript execute a self-referencing read: the script opens and reads its own file contents from disk, then uses regex pattern matching to extract only the lines prefixed with `////` (four forward slashes) — a sub-pattern of the Stage 1 junk-comment prefix, so the real payload hides in plain sight inside what looks like more filler.
Stage 3 — the extracted `////` lines assemble into a VBScript payload. This VBScript instantiates a `WScript.Network` COM object and issues the equivalent of `net use` to map a network drive against a WebDAV/SMB share hosted at the attacker domain sokingscrosshotel[.]com. It then invokes WMI (via `wmiprvse.exe`) to spawn `msiexec.exe`, which silently pulls and installs the remote MSI package (upd.msi) from the newly mapped share — a technique that lets the actual malicious binary traverse the network as a signed-looking installer transaction rather than a direct HTTP/S download, and keeps msiexec.exe (a trusted LOLBin) as the visible parent/executing process for defense products. After installation, the script calls `RemoveNetworkDrive` to unmap the share and reduce artifacts left on disk.
The resulting MSI installs the Latrodectus DLL loader, which performs extensive sandbox/anti-analysis checks before beaconing: process-count thresholds (75+ processes required on Windows 10, 50+ on earlier versions), MAC address allow-listing, and CPU architecture validation. It registers a mutex ("runnung" — a deliberately misspelled string) to prevent reinfection, then beacons to its C2 over HTTP POST with RC4-encrypted (hardcoded key "12345"), base64-encoded parameters, frequently fronted behind Cloudflare. Latrodectus functions purely as a loader/downloader: core capabilities are host/domain enumeration, arbitrary DLL/EXE execution by export name, self-update, and self-restart. It has been observed downloading follow-on payloads including QakBot, DarkGate, PikaBot, and IcedID's own "bp.dat" module, making it a common first-stage foothold ahead of ransomware and other high-impact intrusions. Distribution has historically included thread-hijacked phishing emails with malicious links, oversized JavaScript attachments retrieved via curl, ISO files containing LNK stagers, and fake contact-form copyright-infringement lures.
MITRE ATT&CK techniques used in TL-2026-1486
Collection
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1069.002 Domain Groups; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087.002 Domain Account; T1135 Network Share Discovery; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
Lateral Movement
T1021.005 VNC; T1570 Lateral Tool Transfer
Defense Evasion
T1027.001 Binary Padding; T1027.002 Software Packing; T1027.007 Dynamic API Resolution; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1218.011 Rundll32; T1497.001 System Checks; T1564.004 NTFS File Attributes; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1047 Windows Management Instrumentation; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1106 Native API; T1204.002 Malicious File
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Command and Control
T1071.001 Web Protocols; T1102 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1573.001 Symmetric Cryptography
Impact
execution
T1559.001 Component Object Model
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
Affected products and versions in Latrodectus Loader
- Microsoft — Windows (wscript.exe/cscript.exe, WMI, msiexec.exe, WebClient/WebDAV redirector)
Vulnerable versions: Windows 10; Windows 11; Windows Server (all supported)
Remediation for Latrodectus Loader
Immediate actions
- Block network egress and DNS resolution to sokingscrosshotel[.]com and any newly registered WebDAV/SMB C2 domains
- Block/alert on outbound SMB/WebDAV connections (TCP 445, 80/443 WebClient) initiated from user workstations to external IPs
- Hunt for the SHA256 71fb25cc4c05ce9dd94614ed781d85a50dccf69042521abc6782d48df85e6de9 across endpoint and email gateway logs
- Alert on msiexec.exe spawned as a child of wmiprvse.exe or wscript.exe/cscript.exe
- Alert on WScript.Network COM object usage (net use / MapNetworkDrive) followed immediately by RemoveNetworkDrive within the same script execution
Workarounds
- Restrict outbound SMB (445) and WebDAV client traffic to the internet at the network perimeter
- Disable WebClient service where WebDAV is not a business requirement
Longer-term hardening
- Deploy EDR behavioral rules for LOLBin abuse chains (wscript/cscript -> WMI -> msiexec)
- Disable or tightly restrict WebClient (WebDAV redirector) service on endpoints that do not require it
- Enforce Attack Surface Reduction rules blocking JS/VBS execution of downloaded content and Office child-process spawning
- Deploy AMSI-integrated script logging (PowerShell/JScript/VBScript ScriptBlock logging equivalent) to capture deobfuscated in-memory script content
- Restrict msiexec.exe to installs from signed/allow-listed sources via AppLocker or WDAC
Timeline of Latrodectus Loader
- Latrodectus first identified as a distinct malware family by Walmart researchers; initially distributed by TA577 across three campaigns in November 2023.
- TA578 becomes the primary Latrodectus operator, shifting from prior favorites IcedID and Bumblebee.
- Public Latrodectus IOC set published (executemalware/Malware-IOCs) covering related campaign domains, IPs, and MSI/DLL hashes contemporaneous with this sample.
- Obfuscated JScript loader sample (SHA256 71fb25cc...85e6de9) uploaded to MalwareBazaar by researcher pr0xylife, one day ahead of Embee Research's public deobfuscation writeup.
- Embee Research publishes deep-dive deobfuscation of a JScript/VBScript Latrodectus loader sample (SHA256 71fb25cc...85e6de9) using junk-comment padding, self-referencing code, and WMI/msiexec-driven MSI installation from sokingscrosshotel[.]com.
- LevelBlue publishes 'Analyzing Latrodectus: The New Face of Malware Loaders,' corroborating the IcedID-successor lineage and detailing loader capabilities (host/domain enumeration, arbitrary DLL/EXE execution by export name, self-update).
- Proofpoint publishes analysis assessing Latrodectus was built by former IcedID developers, documenting shared backend infrastructure, jumpboxes, and anti-analysis techniques (process-count/MAC checks, mutex 'runnung').
- The Hacker News reports Latrodectus emerging as IcedID's successor in ongoing phishing campaigns.
- MITRE ATT&CK publishes Latrodectus as Software S1160 with a consolidated 44-technique mapping sourced from multiple 2024 vendor reports including Unit 42.
Sources cited for Latrodectus Loader
Threats related to Latrodectus Loader
- Latrodectus Phishing Campaign Delivering LummaStealer via 302-Redirect Domain Infrastructure (lufyfeo[.]org, 36-domain cluster)
- Lampion Banking Trojan (ChePro Lineage) Multistage Phishing/Evasion Campaign Targets Portugal
- Operation Endgame: Global Law Enforcement Takedown Disrupts SocGholish, Amadey, and StealC Malware-as-a-Service Networks
- Backdoor.Mistic (MLTBackdoor) — In-Memory BOF-Capable Backdoor Deployed by Woodgnat/KongTuke IAB Alongside ModeloRAT
- Astaroth (Guildma) Banking Trojan Adds WhatsApp Web Spambot Module — STAC3150 / "Boto Cor-de-Rosa" Campaign Self-Propagates Across Brazil
- SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor
Detection coverage for TL-2026-1486
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1486 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.