SmokedHam and Qilin Threats

SmokedHam and Qilin Threats | Orange Cyberdefense

Smoking out an affiliate: SmokedHam, Qilin, a few Google ads and some bossware

TL;DR

In early 2026, Orange Cyberdefense responded to several incidents delivering the SmokedHam backdoor;

In at least one case, the infection chain resulted in the deployment of the Qilin ransomware; We attribute with moderate confidence these activities to the Russian-speaking ransomware affiliate UNC2465, historically associated with DarkSide, LockBit and Hunters International distribution; By pivoting on the infrastructure, we identified multiple malicious malvertising domains responsible for delivering SmokedHam typically masqueraded as legitimate utilities like RVTools; We identified a…