Malsmoke
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:21:48
Targeted industries: media-and-entertainment retail-and-hospitality
Targeted regions: country_code:jp
Context
Malsmoke primarily targets Japanese users through malvertising campaigns that deliver Zloader malware, often leveraging adult content lures and geographic IP information. The group has transitioned from exploit kits, such as Fallout, to social engineering tactics, including fake Java updates, while maintaining a focus on high-traffic adult websites. Their operations are characterized by the use of DGA for C2 server domains and the distribution of payloads via a custom loader, previously relying on Smoke Loader. Connections to past campaigns are evident through similarities in malware masquerading as Java plugins and shared registrar information among domains.
Reports & references
- blog.malwarebytes.com — Malsmoke Operators Abandon Exploit Kits In Favor Of Social Engineering Scheme (report)
- malwarebytes.com — Malvertising Campaigns Come Back In Full Swing (report)