APT Explorer

All actors

SMOKY SPIDER

Also reported as Smoky Spider.

Reports
83
Last reported
Known CVEs
26
ID
smoky-spider
Sources
MISPETDAMalpedia
Merge evidence
2 alias matches

Reports per quarter

Dated reports, 2014 Q4 to 2026 Q2.

Techniques seen in the last two years

Show all 40 techniques Show fewer

Counts come from technique IDs in the actor's report text.

CVEs named in reports

Show all 26 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. Smoky Spider - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  2. Privacy Tools (Not) for You

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. FlawedAmmyy (Malware Family)

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  4. Wizard Spider, Gold Blackburn - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  5. Bamboo Spider, TA544 - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  6. Scully Spider, TA547 - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  7. Doppel Spider - Threat Group Cards: A Threat Actor Encyclopedia

    date ORKL added it ORKL

    The title opens a link whose publisher is not confirmed. Archived copy on ORKL Details

  8. What We Thought Was SMOKELOADER: Introducing REMUS

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Defensive Rootkits: Engineering Kernel-Level Malware Analysis from Ring 0

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. Technical Analysis of SmokeLoader Version 2025 | ThreatLabz

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 83 reports Show fewer

  1. Operation Endgame: Do Takedowns and Arrests Matter?

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Operation Endgame follow-up leads to five detentions and interrogations as well as server takedowns

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. TLP-CLEAR-From-espionage-to-PsyOps-Tracking-operations-and-infrastructure-of-UACs-in-2025-EN-1.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. SmokeLoader Malware Targets Ukraine’s Auto & Banking Sectors via Open Directories

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. SmokeLoader Attack Targets Companies in Taiwan | FortiGuard Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  7. FortiMail Workspace Security | Fortinet

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Correlating Vidar Stealer Build IDs Based on Loader Tasks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Exposing FakeBat loader: distribution methods and adversary infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. SmokeLoader History | ThreatLabz

    Malpedia library date ORKL

    Archived copy on ORKL Details

  11. Largest ever operation against botnets hits dropper malware ecosystem

    Malpedia library date ORKL

    Archived copy on ORKL Details

  12. Taking a deep dive into SmokeLoader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  13. CrackedCantil: Malware Work Together

    Malpedia library date ORKL

    Archived copy on ORKL Details

  14. Understanding Internals of SmokeLoader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  15. Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike

    Malpedia library date ORKL

    Archived copy on ORKL Details

  16. Gamaredon_activity, копия

    Malpedia library date ORKL

    Archived copy on ORKL Details

  17. 8Base ransomware stays unseen for a year

    Malpedia library date ORKL

    Archived copy on ORKL Details

  18. 8Base Ransomware: A Heavy Hitting Player

    Malpedia library date ORKL

    Archived copy on ORKL Details

  19. Malware Analysis and Deobfuscation With Procmon - Smokeloader Example

    Malpedia library date ORKL

    Archived copy on ORKL Details

  20. RIG___TLP_CLEAR-1.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  21. Malicious Packer pkr_ce1a

    Malpedia library date ORKL

    Archived copy on ORKL Details

  22. Trellix Insights: SmokeLoader Exploits Old Vulnerabilities to Drop zgRAT

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  23. Seychelles, Seychelles, on the C(2) Shore

    Malpedia library date ORKL

    Archived copy on ORKL Details

  24. NullMixer: oodles of Trojans in a single dropper

    Malpedia library date ORKL

    Archived copy on ORKL Details

  25. PrivateLoader: the loader of the prevalent ruzki PPI service

    Malpedia library date ORKL

    Archived copy on ORKL Details

  26. Tracking PrivateLoader: Malware Distribution Service

    Malpedia library date ORKL

    Archived copy on ORKL Details

  27. SmokeLoader - Quick-Analysis

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  28. Quick-Analysis/SmokeLoader/SmokeLoader.md at main · vc0RExor/Quick-Analysis

    Malpedia library date ORKL

    Archived copy on ORKL Details

  29. SmokeLoader Triage

    Malpedia library date ORKL

    Archived copy on ORKL Details

  30. An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure

    Malpedia library date ORKL

    Archived copy on ORKL Details

  31. Life After Death—SmokeLoader Continues to Haunt Using Old Vulnerabilities

    Malpedia library date ORKL

    Archived copy on ORKL Details

  32. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  33. Identifying PrivateLoader Network Threats

    Malpedia library date ORKL

    Archived copy on ORKL Details

  34. Amadey Bot Being Distributed Through SmokeLoader - ASEC

    Malpedia library date ORKL

    Archived copy on ORKL Details

  35. AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  36. Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | CISA

    Malpedia library date ORKL

    Archived copy on ORKL Details

  37. SystemBC Being Used by Various Attackers

    Malpedia library date ORKL

    Archived copy on ORKL Details

  38. New Golang botnet empties Windows users’ cryptocurrency wallets

    Malpedia library date ORKL

    Archived copy on ORKL Details

  39. Secure Communications Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  40. PrivateLoader: The first step in many malware schemes

    Malpedia library date ORKL

    Archived copy on ORKL Details

  41. A Deep Dive into Packing Software CryptOne

    Malpedia library date ORKL

    Archived copy on ORKL Details

  42. Look how many cybercriminals love Cobalt Strike

    Malpedia library date ORKL

    Archived copy on ORKL Details

  43. PaaS, or how hackers evade antivirus software

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  44. report-bb-2021-threat-report.pdf

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  45. CopperStealer: Password & Cookie Stealer Malware | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  46. Report2021GTR.pdf

    Malpedia library date ORKL

    Archived copy on ORKL Details

  47. Analytics

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  48. What tracking an attacker email infrastructure tells us about persistent cybercriminal operations | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  49. GCleaner — Garbage Provider Since 2019

    Malpedia library date ORKL

    Archived copy on ORKL Details

  50. 2020: The year in malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  51. Smokeloader is still alive and kickin’ – A new way to encrypt CC server URLs

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  52. Malvertising campaigns come back in full swing | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  53. Malvertising campaigns come back in full swing

    Malpedia library date ORKL

    Archived copy on ORKL Details

  54. Salfram: Robbing the place without removing your name tag

    Malpedia library date ORKL

    Archived copy on ORKL Details

  55. Hatching - Automated malware analysis solutions

    Malpedia library date ORKL

    Archived copy on ORKL Details

  56. Deep Analysis of SmokeLoader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  57. Operation TA505: network infrastructure. Part 3

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

  58. Examining Smokeloader’s Anti Hooking technique

    Malpedia library date ORKL

    Archived copy on ORKL Details

  59. Report2020CrowdStrikeGlobalThreatReport

    Malpedia library date ORKL

    The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Details

  60. Smoke Loader Malware – An Easy Guide 101

    Malpedia library date ORKL

    Archived copy on ORKL Details

  61. The 2019 Resurgence of Smokeloader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  62. 2019: The Return of Retefe | Proofpoint US

    Malpedia library date ORKL

    Archived copy on ORKL Details

  63. Analysis of Smoke Loader in New Tsunami Campaign

    Malpedia library date ORKL

    Archived copy on ORKL Details

  64. A taste of our own medicine : How SmokeLoader is deceiving configuration extraction by using binary code as bait • Raashid Bhat

    Malpedia library date ORKL

    Archived copy on ORKL Details

  65. Dissecting Smoke Loader

    Malpedia library date ORKL

    Archived copy on ORKL Details

  66. Smoking Guns - Smoke Loader learned new tricks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  67. Malware | Smoke Loader malware improves after Microsoft spoils its Campaign

    Malpedia library date ORKL

    Archived copy on ORKL Details

  68. Hunting down Dofoil with Windows Defender ATP | Microsoft Security Blog

    Malpedia library date ORKL

    Archived copy on ORKL Details

  69. Fake Spectre and Meltdown patch pushes Smoke Loader malware | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  70. Crystal Finance Millennium used to spread malware

    Malpedia library date ORKL

    Archived copy on ORKL Details

  71. New-looking Sundown EK drops Smoke Loader, Kronos banker | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  72. Smoke Loader - downloader with a smokescreen still alive | Malwarebytes Labs

    Malpedia library date ORKL

    Archived copy on ORKL Details

  73. Dissecting SmokeLoader (or Yulia's sweet ass proposition)

    Malpedia library date ORKL

    The original link failed its last check. Original publisher Details

Newest first. Details opens the report in Explore.