New YiBackdoor Malware Shares Main Code Overlaps with IcedID and Latrodectus

Sep 24, 2025Ravie LakshmananMalware / Home windows Safety

Cybersecurity researchers have disclosed particulars of a brand new malware household dubbed YiBackdoor that has been discovered to share “important” supply code overlaps with IcedID and Latrodectus.

“The precise connection to YiBackdoor will not be but clear, however it could be used along with Latrodectus and IcedID throughout assaults,” Zscaler ThreatLabz stated in a Tuesday report. “YiBackdoor is ready to execute arbitrary instructions, accumulate system data, seize screenshots, and deploy plugins that dynamically broaden the malware’s performance.”

The cybersecurity firm stated it first recognized the malware in June 2025, including it could be serving as a precursor to follow-on exploitation, comparable to facilitating preliminary entry for ransomware assaults. Solely restricted deployments of YiBackdoor have been detected up to now, indicating it is presently both below growth or being examined.

Given the similarities between YiBackdoor, IcedID, and Latrodectus, it is being assessed with medium to excessive confidence that the brand new malware is the work of the identical builders who’re behind the opposite two loaders. It is also value noting that Latrodectus, in itself, is believed to be a successor of IcedID.

YiBackdoor options rudimentary anti-analysis methods to evade virtualized and sandboxed environments, whereas incorporating capabilities to inject the core performance into the “svchost.exe” course of. Persistence on the host is achieved through the use of the Home windows Run registry key.

“YiBackdoor first copies itself (the malware DLL) right into a newly created listing below a random title,” the corporate stated. “Subsequent, YiBackdoor provides regsvr32.exe malicious_path within the registry worth title (derived utilizing a pseudo-random algorithm) and self-deletes to hinder forensic evaluation.”

An embedded encrypted configuration inside the malware is used to extract the command-and-control (C2) server, after which it establishes a connection to obtain instructions in HTTP responses –

• Systeminfo, to gather system metadata
• display screen, to take a screenshot
• CMD, to execute a system shell command utilizing cmd.exe
• PWS, to execute a system shell command utilizing PowerShell
• plugin, to move a command to an current plugin and transmit the outcomes again to the server
• process, to initialize and execute a brand new plugin that is Base64-encoded and encrypted

Zscaler’s evaluation of YiBackdoor has uncovered quite a lot of code overlaps between YiBackdoor, IcedID, and Latrodectus, together with the code injection methodology, the format and size of the configuration decryption key, and the decryption routines for the configuration blob and the plugins.

“YiBackdoor by default has considerably restricted performance, nonetheless, risk actors can deploy further plugins that broaden the malware’s capabilities,” Zscaler stated. “Given the restricted deployment up to now, it’s possible that risk actors are nonetheless creating or testing YiBackdoor.”

New Variations of ZLoader Noticed

The event comes because the cybersecurity agency examined two new variations of ZLoader (aka DELoader, Terdot, or Silent Evening) – 2.11.6.0 and a pair of.13.7.0 – that incorporate additional enhancements to its code obfuscation, community communications, anti-analysis methods, and evasion capabilities.

Notable among the many adjustments are LDAP-based community discovery instructions that may be leveraged for community discovery and lateral motion, in addition to an enhanced DNS-based community protocol that makes use of customized encryption with the choice of utilizing WebSockets.

Assaults distributing the malware loader are stated to be extra exact and focused, being deployed solely in opposition to a small variety of entities quite than in an indiscriminate trend.

“ZLoader 2.13.7.0 contains enhancements and updates to the customized DNS tunnel protocol for command-and-control (C2) communications, together with added help for WebSockets,” Zscaler stated. “ZLoader continues to evolve its anti-analysis methods, leveraging revolutionary strategies to evade detection.”