Smokeloader

SmokeLoader is a malicious software (malware) that acts as a loader for other malware, injecting malicious code into the currently running explorer process and downloading additional payloads to the system. It has been used in conjunction with Phobos ransomware by threat actors who exploit its functionality to download the Phobos payload and exfiltrate data from compromised systems. These actors often embed the ransomware as a hidden payload using SmokeLoader, which can be delivered through suspicious downloads, emails, or websites. The threat actors also use SmokeLoader to inject code into running processes, identifying an entry point through enabling a VirtualAlloc or VirtualProtect process. Alternatively, they send spoofed email attachments embedded with hidden payloads such as SmokeLoader. Between May 27 and 29, 2024, an international law enforcement operation coordinated by Europol, codenamed Operation Endgame, targeted malware droppers like SmokeLoader. This operation resulted in the dismantling of dropper botnet infrastructure that supported initial-access Trojan malware strains, including IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, and Trickbot. Eight Russian nationals, including Airat Gruber, the suspected admin of SmokeLoader, were added to the list of Europe's most wanted fugitives for their roles behind developing these botnets. In addition to SmokeLoader, Phobos intrusions have involved the use of various open-source tools, including Cobalt Strike and Bloodhound. The government reported at least two massive campaigns since May 20, where threat actors aimed at distributing SmokeLoader malware via email. The malware used in these campaigns includes information stealers such as Mystic Stealer, Rise Pro, and Redline; and loaders such as SmokeLoader and Amadey. As a result of these activities, CERT-UA issued a warning about an increase in cyberattacks targeting Ukrainian finances with SmokeLoader malware.