Smoke Loader
MITRE ATT&CK: S0226 View on attack.mitre.org
Aliases: Dofoil, Sharik, Smoke, Smoke Loader
- First seen
- 2011-01-01 00:00:00
- Malware type
- loader, botnet, credential-stealer
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 5439 (5102 malicious)
- Last IoC activity
- 2026-10-17 03:06:22
- Profile updated
- 2026-07-07 15:43:34
Targeted industries: financial-services healthcare-and-pharmaceutical technology-and-telecommunications government-and-public-sector
Context
Smoke Loader is a malicious bot application that can be used to load other malware. Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins.
Recent IoC activity
5,102 malicious indicators in Maltiverse are attributed to Smoke Loader (S0226). The 20 most recently updated:
Detection coverage
- 282 Sigma rules
Malware & tools used
- Deobfuscate/Decode Files or Information (attack-pattern)
- Credentials In Files (attack-pattern)
- Local Email Collection (attack-pattern)
- Visual Basic (attack-pattern)
- Credentials from Web Browsers (attack-pattern)
- Web Protocols (attack-pattern)
- System Checks (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Registry Run Keys / Startup Folder (attack-pattern)
- Process Hollowing (attack-pattern)
- Encrypted/Encoded File (attack-pattern)
- Process Injection (attack-pattern)
- Scheduled Task (attack-pattern)
- File and Directory Discovery (attack-pattern)
Used by threat actors
- TA577 (threat-actor)
Exploited vulnerabilities
- CVE-2023-38831 (vulnerability)
- CVE-2025-0411 (vulnerability)
Reports & references
- CISA — Aa22 110A (report)
- marcoramilli.com — C2 Traffic Patterns Personal Notes (report)
- CISA — Aa22 110A Joint Csa Russian State Sponsored And Criminal Cyber Threats To Critical Infrastructure 4 20 22 Final (report)
- ptsecurity.com — Antisandbox Techniques (report)
- intrinsec.com — Tlp Clear From Espionage To Psyops Tracking Operations And Infrastructure Of Uacs In 2025 En 1 (report)
- proofpoint.com — 2019 Return Retefe (report)
- CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
- CrowdStrike — Report2021Gtr (report)
- malwarebytes.com — Malvertising Campaigns Come Back In Full Swing (report)
- cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
- medium.com — Inside View Of Brazzzersff Infrastructure 89B9188Fd145 (report)
- ptsecurity.com — Paas Or How Hackers Evade Antivirus Software (report)
- intel471.com — Privateloader Malware (report)
- deepinstinct.com — Deep Dive Packing Software Cryptone (report)
- blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
- Cisco Talos — 2020 Year In Malware (report)
- blackberry.com — Report Bb 2021 Threat Report (report)
- acronis.com — 8Base Ransomware Stays Unseen For A Year (report)
- logpoint.com — Defending Against 8Base (report)
- blogs.vmware.com — 8Base Ransomware A Heavy Hitting Player (report)
- blogs.blackberry.com — Threat Thursday Arkei Infostealer (report)
- ptsecurity.com — Operation Ta505 Part3 (report)
- bleepingcomputer.com — New Golang Botnet Empties Windows Users Cryptocurrency Wallets (report)
- team-cymru.com — Seychelles Seychelles On The C 2 Shore (report)
- medium.com — Gcleaner Garbage Provider Since 2019 2708E7C87A8A (report)