New Malware “YiBackdoor” Linked to IcedID and Latrodectus

Researchers at Zscaler ThreatLabz have uncovered YiBackdoor, first observed in June 2025, with limited deployment but striking code overlaps with IcedID and Latrodectus. According to ThreatLabz, YiBackdoor enables threat actors to collect system information, capture screenshots, execute arbitrary commands, and deploy plugins.

The malware’s architecture shows extensive reuse of techniques from IcedID and Latrodectus, including a similar configuration decryption routine and GZIP-based plugin decryption, plus the use of a unique encryption algorithm. YiBackdoor stores its configuration in encrypted form, rotates encryption keys daily using the day of the week as an offset, and hides C2 traffic inside HTTP headers with responses in the HTTP body.

It also patches the Windows API to redirect execution to the malware’s entry point and achieves persistence via the Windows Run registry key, while loading additional plugins stored as encrypted .bin files in the Windows temp folder. ThreatLabz notes a medium to high confidence of a shared development lineage between YiBackdoor and the two established families, suggesting it could evolve into a significant ransomware access tool. 24 September 2025