SmokeLoader Rises From the Ashes with New, Evasive Variants

SmokeLoader has re-emerged with two new variants after being partially dismantled in 2024’s Operation Endgame, with ThreatLabz researchers reporting updates in early 2025 and again in July 2025. According to ThreatLabz, the rebuilt variants—SmokeLoader 2025 alpha and 2025—fix critical flaws, improve evasion, and enhance plugin functionality, including changes to the network protocol that break compatibility with older versions.

The updates include mutex-based injection control to prevent redundant memory injections, XOR-based encoding for obfuscated constants, and modified persistence that disguises scheduled tasks under names such as MicrosoftEdgeUpdateTaskMachine%hs. Version 2025 also adds a language-aware check to terminate if a Russian keyboard layout is detected and switches to hashing bot IDs with MD5 for unique identifiers, rather than appending “FF”.

The malware’s communication with C2 servers has been adjusted, with the alpha version still masquerading as version 2022 during beaconing while 2025 introduces subtle protocol changes, including CRC32 checksums and XOR-obfuscated C2 responses. ThreatLabz notes that, despite Operation Endgame, SmokeLoader remains updated and used by multiple threat groups, with SmokeBuster released to help detect and remove infections.