Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S1160
MITRE ATT&CK Malware

Latrodectus (S1160)

IceNovaUnidentified 111
ShareXLinkedInRedditHN

[Latrodectus](https://attack.mitre.org/software/S1160) is a Windows malware downloader that has been used since at least 2023 to download and execute additional payloads and modules. [Latrodectus](https://attack.mitre.org/software/S1160) has most often been distributed through email campaigns, primarily by [TA577](https://attack.mitre.org/groups/G1037) and [TA578](https://attack.mitre.org/groups/G1038), and has infrastructure overlaps with historic [IcedID](https://attack.mitre.org/software/S0483) operations.(Citation: Latrodectus APR 2024)(Citation: Bleeping Computer Latrodectus April 2024)(Citation: Bitsight Latrodectus June 2024)

Platforms: Windows

▪Techniques implemented (43)

T1102Web ServiceT1218.011Rundll32T1132.001Standard Encoding

▪Used by groups (2)

G1037TA577G1038TA578
S1160 on MITRE ATT&CK →
T1059.003Windows Command Shell
T1016System Network Configuration Discovery
T1218.007Msiexec
T1135Network Share Discovery
T1057Process Discovery
T1033System Owner/User Discovery
T1053.005Scheduled Task
T1204.001Malicious Link
T1027.007Dynamic API Resolution
T1005Data from Local System
T1566.001Spearphishing Attachment
T1140Deobfuscate/Decode Files or Information
T1070.004File Deletion
T1083File and Directory Discovery
T1559.001Component Object Model
T1027.002Software Packing
T1059.007JavaScript
T1105Ingress Tool Transfer
T1071.001Web Protocols
T1041Exfiltration Over C2 Channel
T1036.005Match Legitimate Resource Name or Location
T1106Native API
T1204.002Malicious File
T1104Multi-Stage Channels
T1482Domain Trust Discovery
T1027.001Binary Padding
T1529System Shutdown/Reboot
T1082System Information Discovery
T1518.001Security Software Discovery
T1573.001Symmetric Cryptography
T1564.004NTFS File Attributes
T1069.002Domain Groups
T1027.013Encrypted/Encoded File
T1547.001Registry Run Keys / Startup Folder
T1497.001System Checks
T1566.002Spearphishing Link
T1047Windows Management Instrumentation
T1622Debugger Evasion
T1087.002Domain Account
T1021.005VNC

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.