Latrodectus – LunarSpider Lab

On October 16, 2025, CorpLocal’s security team spotted a single workstation acting up, followed by a ransom note and proof of massive data theft. What began as one user visiting a malicious site exploded into a full domain takeover: silent process injections, credential harvesting, lightning-fast lateral movement, and a final data haul before the attackers vanished. Welcome to the Latrodectus – LunarSpider lab! Step into the shoes of an elite threat hunter and dismantle a real-world intrusion by the Latrodectus malware. Starting with a drive-by compromise on MS01, they used living-off-the-land binaries, custom DLL beacons, stolen domain accounts, and tools...