Latrodectus / LummaStealer phishing infrastructure tracked via passive DNS and 302 redirects

Key facts for Latrodectus phishing infrastructure

Detection coverage for Latrodectus phishing infrastructure

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4800 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Latrodectus JavaScript Dropper to WebDAV MSI Install Chain — Post-Exploitation (Splunk SPL)

Detects the reported execution chain after the phishing click: wscript/cscript executing a downloaded .js file, msiexec.exe installing an MSI from a WebDAV (DavWWWRoot) or HTTP(S) location, and msiexec spawning rundll32/script-host children that load the Latrodectus DLL ahead of LummaStealer delivery.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.007, T1218.007, T1105
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```JS dropper via wscript/cscript, msiexec install from WebDAV/HTTP, msiexec child processes (T1059.007, T1218.007, T1105)```
(((Image="*wscript.exe" OR Image="*cscript.exe") CommandLine="*.js*" (CommandLine="*Downloads*" OR CommandLine="*Temp*" OR CommandLine="*DavWWWRoot*" OR CommandLine="*Content.Outlook*")) OR (Image="*msiexec.exe" (CommandLine="*DavWWWRoot*" OR CommandLine="*http://*" OR CommandLine="*https://*")) OR (ParentImage="*msiexec.exe" (Image="*rundll32.exe" OR Image="*wscript.exe" OR Image="*cmd.exe" OR Image="*powershell.exe")))
| eval stage=case(like(Image, "%wscript.exe") OR like(Image, "%cscript.exe"), "js_dropper", like(Image, "%msiexec.exe"), "msi_webdav_install", true(), "msi_child_process")
| stats count min(_time) as first_seen max(_time) as last_seen values(stage) as stages values(CommandLine) as command_lines values(ParentImage) as parents by Computer User
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen Computer User stages parents command_lines count

Microsoft KQL

// JavaScript dropper -> WebDAV/HTTP MSI install -> Latrodectus DLL (TL-2026-4800)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("wscript.exe", "cscript.exe")
        and ProcessCommandLine has ".js"
        and ProcessCommandLine has_any ("Downloads", "Temp", "DavWWWRoot", "Content.Outlook"))
    or (FileName =~ "msiexec.exe"
        and ProcessCommandLine has_any ("DavWWWRoot", "http://", "https://", "@SSL"))
    or (InitiatingProcessFileName =~ "msiexec.exe"
        and FileName in~ ("rundll32.exe", "wscript.exe", "cmd.exe", "powershell.exe"))
| extend Stage = case(FileName in~ ("wscript.exe", "cscript.exe"), "js_dropper", FileName =~ "msiexec.exe", "msi_webdav_install", "msi_child_process")
| project Timestamp, DeviceName, AccountName, Stage, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: Latrodectus JavaScript Dropper to WebDAV MSI Install Chain - Post-Exploitation (Splunk SPL)
id: 9c2f6a07-3d48-5b19-8e75-6a0d4c9b1f02
status: experimental
description: Detects the Latrodectus/LummaStealer delivery chain - wscript/cscript running a downloaded .js file, msiexec installing an MSI from WebDAV (DavWWWRoot) or HTTP(S), and msiexec spawning script/DLL host children (TL-2026-4800).
references:
    - https://www.embeeresearch.io/phishing-domain-analysis-with-passive-dns-latrodectus/
    - https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/30
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1218.007
    - attack.command-and-control
    - attack.t1105
    - attack.s1160
    - attack.s1213
logsource:
    category: process_creation
    product: windows
detection:
    selection_js:
        Image|endswith:
            - 'wscript.exe'
            - 'cscript.exe'
        CommandLine|contains: '.js'
    filter_js_path:
        CommandLine|contains:
            - 'Downloads'
            - 'Temp'
            - 'DavWWWRoot'
            - 'Content.Outlook'
    selection_msi:
        Image|endswith: 'msiexec.exe'
        CommandLine|contains:
            - 'DavWWWRoot'
            - 'http://'
            - 'https://'
    selection_msi_child:
        ParentImage|endswith: 'msiexec.exe'
        Image|endswith:
            - 'rundll32.exe'
            - 'wscript.exe'
            - 'cmd.exe'
            - 'powershell.exe'
    condition: (selection_js and filter_js_path) or selection_msi or selection_msi_child
falsepositives:
    - Administrators or software-deployment tools installing MSI packages from internal HTTP(S) or WebDAV shares
    - Legitimate logon or build scripts executed with wscript.exe from user temp paths
level: high

Known false positives:

• Admins or deployment tools (SCCM, Intune, scripts) installing MSIs from internal HTTP(S) or WebDAV shares
• Legitimate logon or build scripts run via wscript.exe from user temp directories

Tuning notes: Allowlist signed software-distribution servers and known deployment accounts for msiexec URL installs. Tighten the .js path conditions to your user-download and mail-cache paths. Consider alerting only when the js_dropper and msi stages occur on the same host within 15 minutes.

• 🔒 Latrodectus/LummaStealer Phishing Infrastructure Contact — Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 Latrodectus JavaScript Dropper to WebDAV MSI Install Chain — Post-Exploitation (Sentinel KQL) · unlock with TL Creds
• 🔒 Latrodectus C2 and Payload Retrieval Over Web Protocols — C2 / Lateral Movement (Sentinel KQL) · unlock with TL Creds
• 🔒 Latrodectus/LummaStealer Phishing Infrastructure Contact — Exploitation (Sigma) · unlock with TL Creds
• 🔒 Latrodectus JavaScript Dropper to WebDAV MSI Install Chain — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 Latrodectus C2 and Payload Retrieval Over Web Protocols — C2 / Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 Latrodectus/LummaStealer Phishing Infrastructure Contact — Exploitation (Splunk SPL) · unlock with TL Creds
• 🔒 Latrodectus C2 and Payload Retrieval Over Web Protocols — C2 / Lateral Movement (Splunk SPL) · unlock with TL Creds

Indicators of compromise for Latrodectus phishing infrastructure

As of 2026-10-30, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-4800.

Sample indicators (3 of 30)

• IP address: 193.106.174[.]218
• Domain: mayanui[.]com
• Domain: quwezui[.]org

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How Latrodectus phishing infrastructure works

Embee Research used passive DNS (Validin) to enumerate the related domains from a Unit 42 report of 2024-03-08.

The campaign was first flagged publicly by Unit 42 (Twitter/X post, 2024-03-08), which described an infection observed around 2024-03-07/08. Embee Research (2024-04-01) pivoted from a phishing link domain using passive DNS (Validin), urlscan and CyberChef-assisted analysis to enumerate the infrastructure: 35 domains are listed in the article body (the title and a mirror cite 36) and all resolve to the single IP 193.106.174.218.

Observed behavior of the hosts: the phishing domains answered with HTTP 302 redirects to the same document URLs on documentcloud.org and to a PDF on harvardlawreview.org, so victims who open the link land on a legitimate-looking document host. Other redirected resources are JavaScript (.js) files. The reported chain is: email phishing link -> 302 redirect -> JavaScript file download and execution -> WebDAV traffic used to fetch an MSI -> MSI installs a Latrodectus DLL -> Latrodectus C2 communication -> LummaStealer payload delivery.

The source article does not publish file hashes, payload filenames, WebDAV URLs or Latrodectus C2 domains, so none are recorded here. Passive DNS pivoting on shared hosting IP and shared redirect targets is the main detection and hunting value: any domain resolving to 193.106.174.218, or returning 302 responses to the documentcloud.org / harvardlawreview.org URLs, is suspect. Latrodectus was first identified in the wild in October 2023 and observed by Proofpoint in email campaigns from late November 2023 (Proofpoint / Team Cymru research); LummaStealer infrastructure was the subject of a Microsoft DCU / DOJ disruption action in May 2025. Severity MEDIUM and status are analyst assignments, not source-stated. No CVE or CVSS is associated. No actor attribution is stated in the sources.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols

Defense Evasion

T1218.007 Msiexec

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Remediation for Latrodectus phishing infrastructure

Immediate actions

• Block the listed domains and IP 193.106.174.218 at DNS, proxy and perimeter firewall
• Retro-hunt DNS, proxy and NetFlow logs for resolutions to or connections with 193.106.174.218 and the listed domains
• Alert on browser or mail-client initiated downloads of .js files followed by msiexec.exe execution
• Reset credentials and revoke sessions for any user whose host executed the chain, since LummaStealer targets stored credentials

Workarounds

• Disable the Windows WebClient service where WebDAV is not required
• Prevent standard users from running MSI packages from user-writable or network paths via Windows Installer policy

Longer-term hardening

• Block or restrict wscript.exe/cscript.exe execution of downloaded .js files via application control or file-association changes
• Restrict outbound WebDAV (WebClient service, DavWWWRoot UNC paths) to the internet
• Use passive DNS pivots on shared hosting IPs to proactively block sibling phishing domains
• Deploy email link-protection that follows redirect chains to their final destination

Affected and fixed versions

• Microsoft — Windows (endpoints targeted by Latrodectus DLL / LummaStealer chain)
  Vulnerable versions: Not version-specific; user-execution based

Timeline of Latrodectus phishing infrastructure

• 2023-10-01 locked-ioc-23 first identified in the wild (October 2023, month precision) per Proofpoint / Team Cymru research; Proofpoint observed email campaigns from late November 2023.
• 2024-03-07 Infection involving the phishing, 302 redirect, JavaScript, WebDAV/MSI and locked-ioc-23 chain observed (reported as March 7-8, 2024).
• 2024-03-08 Unit 42 (@Unit42_Intel) publicly reports the infection chain leading to locked-ioc-23 and locked-ioc-8.
• 2024-04-01 Embee Research publishes passive DNS (Validin) analysis enumerating the related domains on locked-ioc-3 and their 302 redirects to documentcloud.org and harvardlawreview.org.
• 2025-05-13 Microsoft Digital Crimes Unit files legal action against locked-ioc-8; court order enables seizure/blocking of roughly 2,300 malicious domains.
• 2025-05-21 Microsoft publicly announces global action disrupting locked-ioc-8 infrastructure with DOJ and industry partners.

Sources cited for Latrodectus phishing infrastructure

• Passive DNS For Phishing Link Analysis - Identifying 36 Latrodectus Domains With Historical Records and 302 Redirects (Embee Research) embeeresearch.io · Research · 2024-04-01
• Latrodectus: This Spider Bytes Like Ice (Team Cymru) team-cymru.com · Research
• Latrodectus: Spider Bytes Ice (Proofpoint) Proofpoint · Vendor report
• Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID (Elastic Security Labs) elastic.co · Vendor report
• Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool Microsoft · Vendor report · 2025-05-21
• MITRE ATT&CK - Lumma Stealer (S1213) MITRE · Research
• Passive DNS For Phishing Link Analysis - Identifying 36 Latrodectus Domains (mirror summary) hendryadrian.com · Blog
• Lumma Stealer Malware-as-a-Service operation disrupted (Help Net Security) Help Net Security · News · 2025-05-21

More in malware

• CastleLoader debuts in Red Canary top 10: paste-and-run delivery of NetSupport Manager, CastleRAT and .NET infostealer; KongTuke surge
• Recorteiro: Rust banking trojan with 'Recort' screen-hole overlay fraud distributed via fake EnergiaLusa electricity bills in Portugal
• SectopRAT delivered via GPULoader and VMLoader (GPU-based decryption, EtherHiding C2, FakeGuard AitM)
• NotC2: Proof-of-Concept Framework Abuses Amazon Bedrock, SQS, Lambda and SNS as Cloud Command-and-Control
• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig

Previous and next in malware

• Prometei Botnet Linux Binary (Linux/Prometei.B) - Modular Monero Miner and Credential-Stealing Botnet, r2 + AI Reverse Engineering Analysis Previous report
• Malware Infrastructure Reuse Tracked via Passive DNS Pivoting (LokiBot, Bagle, Xworm, Remcos) Next report