Loading threat actor…
Smoky Spider is a financially motivated cybercriminal threat actor associated with the SmokeLoader malware family and the Sasfis downloader. The group is known for operating or distributing loader malware used to establish initial footholds, maintain backdoor access, and deliver additional malicious payloads. SmokeLoader has long been used as a modular malware platform and bot component within criminal operations, enabling follow-on malware deployment and command-and-control activity. Activity attributed to Smoky Spider is characterized by phishing-based delivery as well as secondary installation by other unwanted or malicious software. SmokeLoader exhibits extensive defense-evasion features, including packing, runtime API resolution, code obfuscation, anti-analysis checks, anti-virtual-machine behavior, and anti-debugging techniques. Operationally, the malware has been observed creating suspended processes, performing process hollowing, and injecting into legitimate processes such as Windows Explorer to execute payloads and support command-and-control communications or retrieval of additional malware. The actor’s tooling supports multiple stages of the intrusion lifecycle, including initial access, persistence of malicious execution, post-exploitation, and payload delivery for downstream criminal use. Known aliases directly supported here are limited to Smoky Spider.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
26 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named threat actor referenced in global threat reporting.
Criminal group attributed with using SmokeLoader and Sasfis in malware delivery operations. In this reference, it is associated with phishing-based initial access, use of SmokeLoader as a backdoor/loader, process hollowing, code injection, anti-analysis, anti-VM, and anti-debugging behavior.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.