SmokeLoader Malware Targets Ukraine's Auto & Banking Sectors via Open Directories

Description

An investigation uncovered open directories hosting SmokeLoader malware samples and lure documents targeting Ukraine's automotive and banking sectors. Two servers were identified, containing Windows executables and PDF files posing as invoices from Ukrainian companies. The malware injects into explorer.exe, creates a duplicate in the AppData directory, and communicates with command-and-control servers. The campaign leverages financial-themed lures, impersonating known Ukrainian businesses to increase credibility. The exposed servers reveal the threat actor's staging and distribution methods, providing insight into their operational tactics. This activity demonstrates SmokeLoader's continued use in both cybercrime and espionage-driven attacks against Ukrainian organizations.