Smokeloader

Smokeloader is a malicious software (malware) that has been utilized by threat actors, specifically Phobos actors, to embed ransomware as a hidden payload. This malware, acting as a loader for other malware, infects systems through suspicious downloads, emails, or websites, often without the victim's knowledge. Once executed, Smokeloader injects malicious code into running processes, such as explorer.exe, and downloads additional payloads onto the system. It operates in conjunction with various open-source tools like Cobalt Strike and Bloodhound, and it can also be used to download the Phobos payload and exfiltrate data from compromised systems. The Phobos actors have been known to use Smokeloader to identify entry points into systems by enabling VirtualAlloc or VirtualProtect processes. In some instances, threat actors distribute Smokeloader via spoofed email attachments embedded with hidden payloads. The government experts have reported at least two massive campaigns since May 20 aimed at distributing this malware via email. Notably, Smokeloader was also used in conjunction with other information stealers like Mystic Stealer, Rise Pro, and Redline; and loaders like Amadey. A significant development occurred last month when Operation Endgame dismantled the infrastructure supporting initial-access Trojan malware strains, including Smokeloader. This operation disrupted five botnets, including IcedID and SmokeLoader, which are typically precursors to ransomware or other malware infections. Eight Russian nationals, including Airat Gruber, the suspected admin of Smokeloader, were added to Europe's most wanted fugitives list for their roles in developing these botnets. This coordinated action by European, British, and U.S. police marks a significant blow to the cybercrime ecosystem.