Malware
SmokeLoader
- First Reported
- Feb 6, 2025
- Latest Reported
- Oct 10, 2026
Reported Context (4)
- SmokeLoader,QokBot CYFIRMA Report: Persistent Espionage and Identity Attacks Target India’s Government and Defence Sector
- Earlier “seasons” of Operation Endgame focused on known malware families such as IcedID, Smokeloader, Pikabot, Bumblebee, QakBot, DanaBot, TrickBot, and, most recently in November 2025, the Rhadamanthys infostealer, Operation Endgame Disrupts SocGholish Fake-Update Infrastructure
- families (Vidar, Stealc, Remus, Salat) and undocumented ones, as well as RATs and loaders (e.g. SmokeLoader). ErrTraffic ClickFix Framework Uses Blockchain to Hide C2 and Deliver Malware
- Hunt researchers identified an open directory hosting SmokeLoader samples alongside lure documents targeting Ukraine's automotive and banking sectors. A second related directory contained the same malware but with Open Directories Expose SmokeLoader Campaign Using Ukrainian Banking and Auto Lures
CVE (1)
Malware (34)
People (3)
Threat Actors (30)
MITRE ATT&CK (24)
Vendors (13)
Products (19)
Tools (10)
Industries (11)
Countries (10)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.