SmokeLoader Malware Targets Taiwan's Manufacturing, Healthcare, and IT Sectors

2024-12-02

New opportunity - companies in the manufacturing, healthcare, and IT industries are under threat from SmokeLoader malware. Time to get out your rolodex.

The SmokeLoader malware has resurfaced, targeting manufacturing, healthcare, and IT sectors in Taiwan. Known for its advanced evasion techniques and modular design, SmokeLoader serves as a downloader to deliver other malware but can also execute attacks itself by downloading plugins from its command-and-control server. Despite a decline in activity after Operation Endgame dismantled its infrastructure, SmokeLoader remains active due to publicly available cracked versions. The recent campaign begins with phishing emails containing Excel attachments exploiting old vulnerabilities to deploy SmokeLoader, which uses plugins to steal sensitive data and perform various attacks.

Key Facts

Risks:

Malware, Sensitive Data, Patch Management

Keywords:

SmokeLoader, Malware, Phishing, Taiwan, Manufacturing, Healthcare, IT Security, Data Theft, Ande Loader

CVE:

CVE-2017-0199; CVE-2017-11882

Affected:

Manufacturing, Healthcare, Information Technology, Microsoft Excel, Outlook, Thunderbird, FileZilla, WinSCP

Article Body

SmokeLoader Malware Targets Key Sectors in Taiwan

Taiwan's manufacturing, healthcare, and information technology sectors are facing a new wave of attacks from the SmokeLoader malware. This malware is recognized for its adaptability and sophisticated techniques to avoid detection.

SmokeLoader's Capabilities

Originally emerging in 2011, SmokeLoader is primarily designed to download other malware. However, it can also carry out attacks directly by fetching additional plugins from its command-and-control (C2) servers. These plugins enable it to perform actions like data theft, launching distributed denial-of-service (DDoS) attacks, and cryptocurrency mining.

Evasion Techniques

SmokeLoader employs various methods to avoid detection. It can identify analysis environments, generate fake network traffic, and use code obfuscation. This makes it challenging for analysts to dissect and understand its behavior.

Recent Developments

Following Operation Endgame in May 2024, which dismantled much of its infrastructure, SmokeLoader activity declined. Despite this, it remains in use due to publicly available cracked versions. The current attack campaign begins with phishing emails that contain Microsoft Excel attachments. These exploit older vulnerabilities, such as CVE-2017-0199 and CVE-2017-11882, to deploy an initial loader called Ande Loader, which then installs SmokeLoader.

Attack Methodology

SmokeLoader comprises two main parts: a stager and a main module. The stager decrypts and decompresses the main module, injecting it into the explorer.exe process. The main module establishes persistence, communicates with C2 servers, and executes commands.

Data Theft and Other Threats

Using its plugins, SmokeLoader can steal login credentials, FTP details, email addresses, and cookies from applications like Outlook, Thunderbird, FileZilla, and WinSCP. Instead of downloading a complete file for the final attack stage, it uses these plugins, demonstrating its flexibility.

Implications for Cybersecurity

This resurgence of SmokeLoader highlights the ongoing threat to critical industries in Taiwan. Organizations must remain vigilant, update their security measures, and educate their employees about phishing and other attack vectors to mitigate such threats.

Read More

https://thehackernews.com/2024/12/smokeloader-malware-resurfaces.html?m=1