SMOKY SPIDER

Executive Summary

SMOKY SPIDER, operating SmokeLoader, targets financial sectors and retail through phishing campaigns, deploying malware for credential theft and financial gain.

Goals & Targeting

SMOKY SPIDER's goals seem to be financial gain, targeting sectors with high transactional data. Their victims typically include financial institutions and retail businesses, where compromised credentials can lead to significant losses.

SMOKY SPIDER is a threat actor associated with the SmokeLoader malware, noted in CrowdStrike's 2020 report. They likely distribute additional payloads such as ransomware or infostealers using their primary tool. Their targeting focus suggests intent on stealing sensitive data for financial or competitive advantage.

Key Capabilities

• SmokeLoader malware
• Distribution of ransomware

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Campaigns involve targeted phishing and malware deployment, focusing on sectors with financial value. No specific campaigns known beyond their association with SmokeLoader.

IOC Patterns

• Spear-phishing emails with malicious links
• C2 infrastructure signs like HTTP traffic anomalies

Recommended Actions

• Enhance email filtering
• Implement MFA for sensitive accounts
• Monitor network activity for unknown executables

Suggested Tags