TA516

Also known as: SmokingDro, TA516

This actor typically distributes instances of the SmokeLoader intermediate downloader, which, in turn, downloads additional malware of the actor’s choice – often banking Trojans. Figure 3 shows a lure document from a November campaign in which TA516 distributed fake resumes with malicious macros that, if enabled, launch a PowerShell script that downloads SmokeLoader. In this instance, we observed SmokeLoader downloading a Monero coinminer. Since the middle of 2017, TA516 has used similar macro-laden documents as well as malicious JavaScript hosted on Google Drive to distribute both Panda Banker and a coinminer executable via SmokeLoader, often in the same campaigns.

🌍 Country ["[Unknown]"]

Associated Operations

2016-07 2018-07 2019-11 2020-02 AZORult Campaign Adopts Novel Triple-Encryption Technique AZORult spreads as a fake ProtonVPN installer New AZORult campaign abuses popular VPN service to steal cryptocurrency New version of AZORult stealer improves loading features Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan https://securelist.com/azorult-spreads-as-a-fake-protonvpn-installer/96261/ https://threatpost.com/azorult-campaign-encryption-technique/152508/ https://www.kaspersky.com/about/press-releases/2020_new-azorult-campaign-abuses-popular-vpn-service-to-steal-cryptocurrency https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside https://www.proofpoint.com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojan spreads alongside ransomware in new campaign

Introduction

This actor typically distributes instances of the SmokeLoader intermediate downloader, which, in turn, downloads additional malware of the actor’s choice – often banking Trojans. Figure 3 shows a lure document from a November campaign in which TA516 distributed fake resumes with malicious macros that, if enabled, launch a PowerShell script that downloads SmokeLoader. In this instance, we observed SmokeLoader downloading a Monero coinminer. Since the middle of 2017, TA516 has used similar macro-laden documents as well as malicious JavaScript hosted on Google Drive to distribute both Panda Banker and a coinminer executable via SmokeLoader, often in the same campaigns.

Activities and Tactics

Country of Origin: 🏳️ [“[Unknown]”]

Notable Campaigns

  • 2016-07
  • 2018-07
  • 2019-11
  • 2020-02
  • AZORult Campaign Adopts Novel Triple-Encryption Technique
  • AZORult spreads as a fake ProtonVPN installer
  • New AZORult campaign abuses popular VPN service to steal cryptocurrency
  • New version of AZORult stealer improves loading features
  • Threat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan
  • https://securelist.com/azorult-spreads-as-a-fake-protonvpn-installer/96261/
  • https://threatpost.com/azorult-campaign-encryption-technique/152508/
  • https://www.kaspersky.com/about/press-releases/2020_new-azorult-campaign-abuses-popular-vpn-service-to-steal-cryptocurrency
  • https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside
  • https://www.proofpoint.com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojan
  • spreads alongside ransomware in new campaign

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Smoke Loader
  • PowerDuke
  • POWERSTATS
  • Power Loader
  • Trojan.Karagany
  • POWERSOURCE
  • Miner-C
  • Trojan.Mebromi
  • PowerRAT
  • Remocs:
  • AZORult:
  • Chthonic:
  • Smoke Loader:
  • Zeus Panda:

Attribution and Evidence

Country of Origin: [“[Unknown]”] Additional attribution information pending cataloguing.

References

References pending cataloguing.