Russian-Speaking Lunar Spider Group Launches New Ransomware Wave with Latrodectus V2 Loader

On 2 October 2025, NVISO’s CSIRT released findings on Lunar Spider, a Russian-speaking group known for IcedID activity, which has shifted to distributing Latrodectus V2 to pave the way for ransomware operations. According to NVISO, Lunar Spider has expanded its initial access methods by compromising vulnerable websites in Europe, exploiting Cross-Origin Resource Sharing vulnerabilities, and injecting a FakeCaptcha framework.

The infection chain uses an MSI downloader that contains a legitimate Intel executable (igfxSDK.exe) alongside a malicious DLL known as Latrodectus, with the MSI downloader registering the Intel EXE in a Run registry key to ensure execution and then sideloading Latrodectus via DLL Search Order hijacking.

Once loaded, Latrodectus communicates with its C2 infrastructure to conduct reconnaissance and prepare for follow-on attacks, with the FakeCaptcha framework also monitoring victims and sending interaction data to a Telegram bot channel. NVISO emphasises that Latrodectus is part of a broader supply chain, with Lunar Spider affiliated to ALPHV/BlackCat and Wizard Spider, allowing loaders to help enable post-intrusion ransomware deployments.