SmokeLoader is a long-running, modular Windows loader and backdoor sold on Russian-language cybercrime forums since roughly 2011. Its core job is to gain a foothold and pull down second-stage payloads, but a plugin framework extends it into credential theft, DDoS and cryptomining. It is heavily obfuscated, environment-aware, and generates decoy network traffic to frustrate analysis. In May 2024 its infrastructure was a named target of the Europol-led Operation Endgame; activity continued afterward on new infrastructure, and the author reportedly advertised a new version in 2025. MITRE ATT&CK tracks it as S0226.
Overview
SmokeLoader is commodity malware-as-a-service, not tied to a single actor. As a loader it has delivered a wide range of follow-on malware over the years; in a late-2024 campaign against Taiwanese manufacturing, healthcare and IT firms it downloaded plugins from its C2 to carry out the attack directly rather than dropping a separate family.
Timeline
- ~2011. First advertised on cybercrime forums.
- May–Nov 2023. 23 phishing campaigns against financial departments (Ukraine SSSCIP, Unit 42).
- 27–29 May 2024. Infrastructure disrupted in Operation Endgame.
- Late 2024. Resurfaces targeting Taiwanese firms.
- 2025. Zscaler reports the author advertised a new version with a changed network protocol.
Capabilities & Evasion
- Modular plugin architecture adding credential theft, DDoS and cryptomining. T1105
- Anti-analysis: environment and VM checks and decoy network traffic to blend in. T1497
- Process injection into legitimate processes such as
explorer.exe(vendor-reported; analyst-mapped). T1055 - Multi-layer obfuscation and encoded configuration. T1140
Delivery
Primarily phishing with malicious attachments and links, frequently sent from previously compromised legitimate email accounts to add credibility (the 2023 financial-department campaigns), and also via other loaders and cracked-software lures. T1566.001
MITRE ATT&CK Mapping (S0226)
| Tactic | Technique | Usage |
|---|---|---|
| Persistence | T1547.001 Registry Run Keys / Startup Folder | Autostart |
| Execution | T1059.005 Visual Basic | Startup VB script |
| Command and Control | T1071.001 Web Protocols | HTTP C2 with decoy traffic |
| Credential Access | T1555.003 Web Browsers | Browser credential theft |
| Collection | T1114.001 Local Email Collection | Email theft plugin |
| Command and Control | T1105 Ingress Tool Transfer | Second-stage and plugins |
Operation Endgame
The May 2024 Operation Endgame targeted several loader ecosystems (IcedID, SystemBC, Pikabot, SmokeLoader, Bumblebee, TrickBot), taking down more than 100 servers and seizing roughly 2,000 domains. Europol-attributed figures include more than 50,000 SmokeLoader infections remotely cleansed and up to around 1,000 SmokeLoader C2 domains decommissioned. A follow-up pursued SmokeLoader customers identified from a seized database.
Detection & Mitigation
- Email-security and attachment and link filtering — the primary vector.
- Alert on new Startup-folder scripts and suspicious autorun registry writes, and on injection into system processes.
- Egress filtering and threat-intelligence feeds for C2 domains; EDR rules for decoy-traffic plus credential-store access.
Stop Loaders Before the Payload
Mjolnir Security helps organisations detect loader activity before second-stage malware deploys.
- Managed Detection and Response Monitoring for autostart persistence, injection and decoy-traffic C2 patterns.
- Threat Hunting as a Service Hunting for loader footholds and the second-stage payloads they fetch.
- 24/7 Incident Response Containment before payload deployment. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts