# Latrodectus / LummaStealer phishing infrastructure tracked via passive DNS and 302 redirects

> Phishing links on a cluster of attacker-registered domains hosted on 193.106.174.218 return HTTP 302 redirects to legitimate document-hosting sites (documentcloud.org, harvardlawreview.org) and a JavaScript file that drives WebDAV-based MSI delivery of a Latrodectus DLL, with LummaStealer loaded in the chain. Embee Research used passive DNS (Validin) to enumerate the related domains from a Unit 42 report of 2024-03-08.

- **Published:** 2026-10-30T04:57:43Z
- **Last reviewed:** 2026-10-30T04:57:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4800
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4800.png
- **ID:** TL-2026-4800
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

The campaign was first flagged publicly by Unit 42 (Twitter/X post, 2024-03-08), which described an infection observed around 2024-03-07/08. Embee Research (2024-04-01) pivoted from a phishing link domain using passive DNS (Validin), urlscan and CyberChef-assisted analysis to enumerate the infrastructure: 35 domains are listed in the article body (the title and a mirror cite 36) and all resolve to the single IP 193.106.174.218.

Observed behavior of the hosts: the phishing domains answered with HTTP 302 redirects to the same document URLs on documentcloud.org and to a PDF on harvardlawreview.org, so victims who open the link land on a legitimate-looking document host. Other redirected resources are JavaScript (.js) files. The reported chain is: email phishing link -> 302 redirect -> JavaScript file download and execution -> WebDAV traffic used to fetch an MSI -> MSI installs a Latrodectus DLL -> Latrodectus C2 communication -> LummaStealer payload delivery.

The source article does not publish file hashes, payload filenames, WebDAV URLs or Latrodectus C2 domains, so none are recorded here. Passive DNS pivoting on shared hosting IP and shared redirect targets is the main detection and hunting value: any domain resolving to 193.106.174.218, or returning 302 responses to the documentcloud.org / harvardlawreview.org URLs, is suspect. Latrodectus was first identified in the wild in October 2023 and observed by Proofpoint in email campaigns from late November 2023 (Proofpoint / Team Cymru research); LummaStealer infrastructure was the subject of a Microsoft DCU / DOJ disruption action in May 2025. Severity MEDIUM and status are analyst assignments, not source-stated. No CVE or CVSS is associated. No actor attribution is stated in the sources.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.007 JavaScript
- T1218.007 Msiexec
- T1071.001 Web Protocols
- T1583.001 Domains
- T1608.001 Upload Malware

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Latrodectus JavaScript Dropper to WebDAV MSI Install Chain — Post-Exploitation (Splunk SPL)** (`TL-2026-4800-SPL-002`)

Detects the reported execution chain after the phishing click: wscript/cscript executing a downloaded .js file, msiexec.exe installing an MSI from a WebDAV (DavWWWRoot) or HTTP(S) location, and msiexec spawning rundll32/script-host children that load the Latrodectus DLL ahead of LummaStealer delivery.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1059.007, T1218.007, T1105
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```JS dropper via wscript/cscript, msiexec install from WebDAV/HTTP, msiexec child processes (T1059.007, T1218.007, T1105)```
(((Image="*wscript.exe" OR Image="*cscript.exe") CommandLine="*.js*" (CommandLine="*Downloads*" OR CommandLine="*Temp*" OR CommandLine="*DavWWWRoot*" OR CommandLine="*Content.Outlook*")) OR (Image="*msiexec.exe" (CommandLine="*DavWWWRoot*" OR CommandLine="*http://*" OR CommandLine="*https://*")) OR (ParentImage="*msiexec.exe" (Image="*rundll32.exe" OR Image="*wscript.exe" OR Image="*cmd.exe" OR Image="*powershell.exe")))
| eval stage=case(like(Image, "%wscript.exe") OR like(Image, "%cscript.exe"), "js_dropper", like(Image, "%msiexec.exe"), "msi_webdav_install", true(), "msi_child_process")
| stats count min(_time) as first_seen max(_time) as last_seen values(stage) as stages values(CommandLine) as command_lines values(ParentImage) as parents by Computer User
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen Computer User stages parents command_lines count
````

### Microsoft KQL

```kql
// JavaScript dropper -> WebDAV/HTTP MSI install -> Latrodectus DLL (TL-2026-4800)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName in~ ("wscript.exe", "cscript.exe")
        and ProcessCommandLine has ".js"
        and ProcessCommandLine has_any ("Downloads", "Temp", "DavWWWRoot", "Content.Outlook"))
    or (FileName =~ "msiexec.exe"
        and ProcessCommandLine has_any ("DavWWWRoot", "http://", "https://", "@SSL"))
    or (InitiatingProcessFileName =~ "msiexec.exe"
        and FileName in~ ("rundll32.exe", "wscript.exe", "cmd.exe", "powershell.exe"))
| extend Stage = case(FileName in~ ("wscript.exe", "cscript.exe"), "js_dropper", FileName =~ "msiexec.exe", "msi_webdav_install", "msi_child_process")
| project Timestamp, DeviceName, AccountName, Stage, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Latrodectus JavaScript Dropper to WebDAV MSI Install Chain - Post-Exploitation (Splunk SPL)
id: 9c2f6a07-3d48-5b19-8e75-6a0d4c9b1f02
status: experimental
description: Detects the Latrodectus/LummaStealer delivery chain - wscript/cscript running a downloaded .js file, msiexec installing an MSI from WebDAV (DavWWWRoot) or HTTP(S), and msiexec spawning script/DLL host children (TL-2026-4800).
references:
    - https://www.embeeresearch.io/phishing-domain-analysis-with-passive-dns-latrodectus/
    - https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/30
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.007
    - attack.defense-evasion
    - attack.t1218.007
    - attack.command-and-control
    - attack.t1105
    - attack.s1160
    - attack.s1213
logsource:
    category: process_creation
    product: windows
detection:
    selection_js:
        Image|endswith:
            - 'wscript.exe'
            - 'cscript.exe'
        CommandLine|contains: '.js'
    filter_js_path:
        CommandLine|contains:
            - 'Downloads'
            - 'Temp'
            - 'DavWWWRoot'
            - 'Content.Outlook'
    selection_msi:
        Image|endswith: 'msiexec.exe'
        CommandLine|contains:
            - 'DavWWWRoot'
            - 'http://'
            - 'https://'
    selection_msi_child:
        ParentImage|endswith: 'msiexec.exe'
        Image|endswith:
            - 'rundll32.exe'
            - 'wscript.exe'
            - 'cmd.exe'
            - 'powershell.exe'
    condition: (selection_js and filter_js_path) or selection_msi or selection_msi_child
falsepositives:
    - Administrators or software-deployment tools installing MSI packages from internal HTTP(S) or WebDAV shares
    - Legitimate logon or build scripts executed with wscript.exe from user temp paths
level: high

```

**Known false positives:**

- Admins or deployment tools (SCCM, Intune, scripts) installing MSIs from internal HTTP(S) or WebDAV shares
- Legitimate logon or build scripts run via wscript.exe from user temp directories

**Tuning notes:** Allowlist signed software-distribution servers and known deployment accounts for msiexec URL installs. Tighten the .js path conditions to your user-download and mail-cache paths. Consider alerting only when the js_dropper and msi stages occur on the same host within 15 minutes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Latrodectus/LummaStealer Phishing Infrastructure Contact — Exploitation (Sentinel KQL) (locked: unlock with TL Creds)
- Latrodectus JavaScript Dropper to WebDAV MSI Install Chain — Post-Exploitation (Sentinel KQL) (locked: unlock with TL Creds)
- Latrodectus C2 and Payload Retrieval Over Web Protocols — C2 / Lateral Movement (Sentinel KQL) (locked: unlock with TL Creds)
- Latrodectus/LummaStealer Phishing Infrastructure Contact — Exploitation (Sigma) (locked: unlock with TL Creds)
- Latrodectus JavaScript Dropper to WebDAV MSI Install Chain — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- Latrodectus C2 and Payload Retrieval Over Web Protocols — C2 / Lateral Movement (Sigma) (locked: unlock with TL Creds)
- Latrodectus/LummaStealer Phishing Infrastructure Contact — Exploitation (Splunk SPL) (locked: unlock with TL Creds)
- Latrodectus C2 and Payload Retrieval Over Web Protocols — C2 / Lateral Movement (Splunk SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `193.106.174[.]218`
- Domain: `mayanui[.]com`
- Domain: `quwezui[.]org`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Passive DNS For Phishing Link Analysis - Identifying 36 Latrodectus Domains With Historical Records and 302 Redirects (Embee Research)](https://www.embeeresearch.io/phishing-domain-analysis-with-passive-dns-latrodectus/)
- [Passive DNS For Phishing Link Analysis - Identifying 36 Latrodectus Domains (mirror summary)](https://www.hendryadrian.com/?p=10178)
- [Latrodectus: This Spider Bytes Like Ice (Team Cymru)](https://team-cymru.com/post/latrodectus-this-spider-bytes-like-ice)
- [Latrodectus: Spider Bytes Ice (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice)
- [Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID (Elastic Security Labs)](https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus)
- [Disrupting Lumma Stealer: Microsoft leads global action against favored cybercrime tool](https://blogs.microsoft.com/on-the-issues/2025/05/21/microsoft-leads-global-action-against-favored-cybercrime-tool/)
- [Lumma Stealer Malware-as-a-Service operation disrupted (Help Net Security)](https://www.helpnetsecurity.com/2025/05/21/lumma-stealer-malware-as-a-service-operation-disrupted/)
- [MITRE ATT&CK - Lumma Stealer (S1213)](https://attack.mitre.org/software/S1213)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4800