By: Joshua Platt and Jason Reaves

Zscaler ThreatLabz has uncovered a new backdoor malware, YiBackdoor, that shares extensive code with IcedID and Latrodectus and is being tested for ransomware ops.

Zscaler spotted YiBackdoor, a new modular malware with code overlaps with IcedID and Latrodectus. It uses a stealthy DLL injection to run commands remotely.

Russian-speaking Lunar Spider group is using the sophisticated Latrodectus V2 loader and a FakeCaptcha lure to gain initial access for ransomware operations.