New YiBackdoor Malware Shares Major Code Overlaps with IcedID and Latrodectus

Cybersecurity researchers have disclosed a new malware family dubbed YiBackdoor, which shares significant source code overlaps with IcedID and Latrodectus. The researchers say YiBackdoor first appeared in June 2025 and may serve as a precursor to follow-on exploitation, such as facilitating initial access for ransomware attacks, though only limited deployments have been detected so far.

The analysis notes overlaps in code injection methods, configuration decryption keys, and plugin decryption routines between YiBackdoor, IcedID and Latrodectus, and it suggests the three families could be the work of the same developers, albeit with claims that require further verification.

YiBackdoor features rudimentary anti-analysis techniques and injects core functionality into svchost.exe, with persistence achieved via the Windows Run registry key; it copies itself into a randomly named directory and uses a regsvr32.exe path in the registry before self-deleting to hinder forensic analysis, according to Zscaler ThreatLabz in a Tuesday report.

The researchers warn that YiBackdoor’s default functionality is limited, but threat actors can deploy additional plugins to expand its capabilities, and its embedded encrypted configuration is used to locate the C2 server and receive commands. According to Zscaler ThreatLabz, given the similarities to IcedID and Latrodectus, there is medium to high confidence that the same developers are behind these loaders.