SMOKY SPIDER (Threat Actor)

SYMBOL	COMMON_NAME	aka. SYNONYMS

SMOKY SPIDER (Back to overview)

Mentioned as operator of SmokeLoader in CrowdStrike's 2020 Report.

Associated Families

win.smokeloader

References

2021-06-10 ⋅ ZAYOTEM ⋅ Fatih YILMAZ, Buğra KÖSE, İrem ALKAŞİ, Esmanur ALİCAN, Çağlar YÜN
SmokeLoader Technical Analysis Report
SmokeLoader

2021-05-26 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
A Deep Dive into Packing Software CryptOne
Cobalt Strike Dridex Emotet Gozi ISFB Mailto QakBot SmokeLoader WastedLocker Zloader

2021-05-19 ⋅ Intel 471 ⋅ Intel 471
Look how many cybercriminals love Cobalt Strike
BazarBackdoor Cobalt Strike Hancitor QakBot SmokeLoader SystemBC TrickBot

2021-04-12 ⋅ PTSecurity ⋅ PTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader

2021-03-21 ⋅ Blackberry ⋅ Blackberry Research
2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot

2021-03-18 ⋅ Proofpoint ⋅ Brandon Murphy, Dennis Schwarz, Jack Mott, Proofpoint Threat Research Team
Now You See It, Now You Don’t: CopperStealer Performs Widespread Theft
CopperStealer SmokeLoader

2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader KNOCKOUT SPIDER OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER

2021-02-18 ⋅ PTSecurity ⋅ PTSecurity
https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/
Poet RAT Gravity RAT Ketrican Okrum OopsIE Remcos RogueRobinNET RokRAT SmokeLoader

2021-02-02 ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader

2021-02-01 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
What tracking an attacker email infrastructure tells us about persistent cybercriminal operations
Dridex Emotet Makop Ransomware SmokeLoader TrickBot

2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP

2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Command and Control Traffic Patterns
ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot

2020-12-23 ⋅ 0xC0DECAFE ⋅ Thomas Barabosch
Detect RC4 in (malicious) binaries
SmokeLoader Zloader

2020-12-21 ⋅ Cisco Talos ⋅ JON MUNSHAW
2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader

2020-12-17 ⋅ Telekom ⋅ Thomas Barabosch
Smokeloader is still alive and kickin’ – A new way to encrypt CC server URLs
SmokeLoader

2020-09-09 ⋅ Malwarebytes ⋅ Threat Intelligence Team
Malvertising campaigns come back in full swing
Raccoon SmokeLoader

2020-09-02 ⋅ Cisco Talos ⋅ Holger Unterbrink, Edmund Brumaghin
Salfram: Robbing the place without removing your name tag
Ave Maria ISFB SmokeLoader Zloader

2020-08-27 ⋅ Hatching.io ⋅ Pete Cowman
Smokeloader Analysis and More Family Detections
SmokeLoader

2020-06-22 ⋅ security.neurolabs ⋅ Marcos Alvares
Comparative analysis between Bindiff and Diaphora - Patched Smokeloader Study Case
SmokeLoader

2020-06-21 ⋅ N1ght-W0lf Blog ⋅ Abdallah Elshinbary
Deep Analysis of SmokeLoader
SmokeLoader

2020-05-24 ⋅ Malware and Stuff ⋅ Andreas Klopsch
Examining Smokeloader’s Anti Hooking technique
SmokeLoader

2020-05-24 ⋅ Positive Technologies ⋅ PT ESC Threat Intelligence
Operation TA505: network infrastructure. Part 3.
AndroMut Buhtrap SmokeLoader

2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER Pirate Panda SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER

2020-02-18 ⋅ Github (DanusMinimus) ⋅ Dan Lisichkin
Analyzing Modern Malware Techniques Part 4: I’m afraid of no packer(Part 1 of 2)
SmokeLoader

2019-11-21 ⋅ SentinelOne ⋅ Mario Ciccarelli
Going Deep | A Guide to Reversing Smoke Loader Malware
SmokeLoader

2019-07-09 ⋅ Check Point ⋅ Israel Gubi
The 2019 Resurgence of Smokeloader
SmokeLoader

2019-05-02 ⋅ Proofpoint ⋅ Bryan Campbell, Proofpoint Threat Insight Team
2019: The Return of Retefe
Dok Retefe SmokeLoader

2018-09-18 ⋅ int 0xcc blog ⋅ Raashid Bhat
A taste of our own medicine: How SmokeLoader is deceiving configuration extraction by using binary code as bait
SmokeLoader

2018-08-14 ⋅ Plug it, play it, burn it, rip it ⋅ Alberto Ortega
Anti-Hooking checks of SmokeLoader 2018
SmokeLoader

2018-07-18 ⋅ CERT.PL ⋅ Michał Praszmo
Dissecting Smoke Loader
SmokeLoader

2018-07-03 ⋅ Talos Intelligence ⋅ Ben Baker, Holger Unterbrink
Smoking Guns - Smoke Loader learned new tricks
SmokeLoader TrickBot

2018-04-16 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Smoke Loader malware improves after Microsoft spoils its Campaign
SmokeLoader

2018-04-04 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Hunting down Dofoil with Windows Defender ATP
SmokeLoader

2018-01-12 ⋅ Malwarebytes ⋅ Jérôme Segura
Fake Spectre and Meltdown patch pushes Smoke Loader malware
SmokeLoader

2017-08-24 ⋅ Blaze's Security Blog ⋅ BartBlaze
Crystal Finance Millennium used to spread malware
Chthonic SmokeLoader

2017-08-04 ⋅ PhishLabs ⋅ Jason Davison
Smoke Loader Adds Additional Obfuscation Methods to Mitigate Analysis
SmokeLoader

2017-04-03 ⋅ Malware Breakdown ⋅ Malware Breakdown
Shadow Server Domains Leading to RIG Exploit Kit Dropping Smoke Loader
SmokeLoader

2016-10-17 ⋅ Malwarebytes ⋅ Jérôme Segura
New-looking Sundown EK drops Smoke Loader, Kronos banker
Kronos SmokeLoader

2016-08-05 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Smoke Loader – downloader with a smokescreen still alive
SmokeLoader

2014-10-05 ⋅ Eternal Todo ⋅ Jose Miguel Esparza
Dissecting SmokeLoader (or Yulia's sweet ass proposition)
SmokeLoader

Credits: MISP Project