Operation Endgame: Up In Smoke

IntroductionSmoke (a.k.a. SmokeLoader or Dofoil) is a malware loader that has been operational since 2011. Smoke is primarily used to deliver second-stage malware payloads including various trojans, ransomware, and information stealers. In addition, Smoke can deploy its own custom plugins that extend its functionality including mining cryptocurrency, harvesting credentials, and hijacking web browser data. Smoke is sold as a crimeware kit that enables a threat actor to easily set up and launch attacks. There are numerous versions of the kit …

addition browser can credentials cryptocurrency custom data deploy endgame hijacking information information stealers loader malware mining operational operation endgame own payloads plugins ransomware smoke smokeloader stage stealers trojans web web browser