SMOKEDHAM

Executive Summary

SMOKEDHAM is a PowerShell‑based .NET backdoor used by ransomware affiliates such as DarkSide. It establishes persistent, encrypted C2 channels, delivers auxiliary payloads, and supports data exfiltration under the guise of legitimate HTTPS traffic. Security teams should monitor for encoded PowerShell commands, block known C2 domains, and implement strict execution policies.

SMOKEDHAM is a malware family composed of PowerShell‑based .NET backdoor components that first surfaced in the FireEye security briefings in May 2021. The code base has been observed being used by at least one ransomware‑as‑a‑service affiliate, specifically the DarkSide operation, indicating that SMOCKENHAM serves as a versatile command and control (C2) platform for delivering additional payloads such as ransomware installers. The backdoor operates entirely in memory using dynamically loaded .NET assemblies executed through encoded PowerShell commands. This delivery mechanism allows it to evade traditional signature‑based detection while maintaining persistence on the victim’s Windows system via registry run keys or scheduled tasks. SMOKEDHAM can receive remote instructions, download additional modules, establish encrypted tunnels, and exfiltrate data from compromised machines. Because the operators use a standard .NET framework for both execution logic and communication encryption, most network activity is disguised as benign HTTPS traffic, making it difficult to flag without behavioral analysis. The tool’s modular design also means new subcomponents can be injected on‑the‑fly, enabling flexibility in lateral movement, privileged escalation, or ransomware deployment. Overall, SMOKEDHAM represents a sophisticated backdoor that enhances an attacker’s ability to maintain covert footholds within enterprise environments and facilitate the rapid rollout of opportunistic ransomware campaigns.

Key Capabilities

• Remote command and script execution via encoded PowerShell
• Persistent installation using registry run keys or scheduled tasks
• Dynamic loading of .NET assemblies in memory
• Encrypted communication over HTTPS
• Capability to download and execute additional modules
• Data exfiltration through standard web protocols

Recommended Actions

• Block outbound traffic to known SMOKEDHAM C2 IPs and domains