Latrodectus malware and how to defend against it with Wazuh

Latrodectus is a modular, fileless Windows malware family observed in campaigns since late 2023 that uses dynamic API resolution, string obfuscation, persistence via scheduled tasks, environment and VM checks, mutexes, and encrypted HTTPS C2 to perform selective data exfiltration and to download additional modules (including ransomware). The report details tactics and techniques, links activity to TA577/TA578, and provides mitigation guidance such as phishing training, endpoint detection, network segmentation, backups, and patching, plus how Wazuh can detect related behaviors.