Loading story…
The website of Crystal Finance Millennium, a Ukrainian vendor of medical and accounting software, was compromised and used to deliver multiple malware families, including Smoke Loader, Chthonic, and the PSCrypt ransomware. Malicious files were hosted on cfm.com.ua and supported by additional domains, with payloads dropped into %AppData% and outbound connections made to external command-and-control infrastructure. After the compromise was identified, the hosting provider took the site offline.
The incident linked a well-known downloader to a broader multi-stage infection chain. Smoke Loader has remained active as a malware delivery tool and has been observed fetching follow-on payloads, establishing persistence through Windows Run registry keys, contacting decoy and command-and-control domains, and enabling delivery of additional malware families. In the Crystal Finance Millennium intrusion, PSCrypt encrypted files with the .pscrypt extension, demanded 3,500 Hryvnia, cleared event logs, and removed RDP-related files and registry keys, reinforcing concerns that the compromise formed part of a targeted campaign against Ukrainian organizations.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
On 2017-11-02, analysts observed Sharik/Smoke Loader downloaded from 89.38.98[.]150, which then fetched Neutrino malware and ultimately multiple Lethic spambot binaries. The chain included persistence via Run keys and communications with eeaglelifedd[.]com and a .bit domain.
Payment history tied to PSCrypt ransom activity led the researcher to conclude the Crystal Finance Millennium website had been compromised by 15 August, and possibly as early as 14 August. The compromised site was then used to distribute Smoke Loader, Chthonic, and PSCrypt.
Malwarebytes published analysis describing Smoke Loader as a still-active downloader malware family. This establishes prior activity of one of the malware families later seen in the Crystal Finance Millennium compromise.
After the compromise was identified, the hosting provider took the Crystal Finance Millennium website offline. The site had been serving multiple malware families from paths on cfm.com.ua.
The Crystal Finance Millennium analysis states that Chthonic had been observed in June targeting a government institution in Ukraine. This is cited as prior Ukraine-focused activity involving one of the malware families served through the compromised site.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
malware-traffic-analysis.net
Open sourcebartblaze.blogspot.com
Open sourceblog.malwarebytes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple financially motivated malware campaigns using **SmokeLoader** as a delivery mechanism for follow-on payloads including **Gozi ISFB**, **ZLoader**, **Oski**, **AveMaria**, **Cobalt Strike**, **SystemBC**, **RecordBreaker**, and the **Laplas Clipper** cryptocurrency hijacker. In one campaign set, attackers abused website contact forms and sent phishing lures posing as copyright complaints, directing victims to malicious documents hosted on legitimate services such as **Google Drive**. Talos found the initial payloads were wrapped in a shared crypter identified by the DOS-stub string **"Salfram,"** indicating a common tooling layer across otherwise varied malware deliveries. The activity relied on evasive and modular infection chains designed to complicate detection and maximize monetization. The **Salfram** crypter used obfuscation methods including fake API calls, fragmented control flow, self-modifying code, and memory allocation through `ZwAllocateVirtualMemory`, while later-stage malware added persistence and theft capabilities. Cyble said **Laplas Clipper** monitored the clipboard for cryptocurrency wallet addresses, pulled regex patterns and replacement addresses from `clipper[.]guru`, and persisted by copying itself into `%appdata%` and creating a scheduled task that ran every minute. The combined use of phishing, legitimate hosting platforms, crypter-based obfuscation, and multi-payload delivery shows an adaptable criminal ecosystem built to steal credentials, proxy access, banking data, and cryptocurrency funds.
Aug 15, 2026
Threat researchers reported a malware campaign that used fake privacy-tool websites to trick users into downloading trojanized Windows installers that delivered **SmokeLoader**. Identified lure domains included `privacytools[.]xyz`, `privacytoolsforyou[.]site`, `privacmytools[.]site`, and `privacy-tools-for-you-777[.]com`, with one malicious installer tracked by SHA-256 `47906fc0ac7d3be54c62933e5f66a285cd34f161ce1d8a1bbdf80dc2e1df1441`. The operation relied on spoofed software-download pages and rogue file-hosting sites designed to resemble legitimate privacy software distribution. Investigators linked the activity to a broad and frequently changing infrastructure that included at least 26 fake privacy-tool domains, 18 related file-hosting domains, numerous command-and-control URLs across TLDs such as `.space`, `.ru`, `.site`, `.xyz`, and `.com`, and shared bulletproof hosting. Some file-hosting domains also appeared to serve as **SmokeLoader** C2 nodes, while additional indicators included DNS-linked IP addresses and RSA key material associated with encrypted malware communications, underscoring a coordinated malware delivery and control network.
Aug 15, 2026
Researchers detailed the **CrackedCantil** campaign, in which victims searching for cracked software were funneled through Google Groups results and password-protected archives into a coordinated multi-stage malware infection chain. The operation used **PrivateLoader** as a central distributor and tasking mechanism, with additional malware including **SmokeLoader**, **Lumma**, **RedLine**, **RisePro**, **Amadey**, **StealC**, **Vidar**, **Socks5systemz**, a coinminer, and **STOP ransomware**. Reported behaviors included PowerShell execution, credential theft, keylogging, browser-data collection, screenshots, system discovery, persistence, and defense evasion. The infection chain was designed to maximize theft and system abuse before file encryption, with environment-aware payload delivery, randomized filenames, and encrypted or Base64-encoded command-and-control traffic helping the malware evade detection. Infostealers harvested credentials and host data, proxyware and mining components monetized compromised machines, and STOP ransomware later encrypted files, persisted across reboot, and in some cases appended extensions such as `.hhaz`. Researchers said the campaign reflects a deliberately coordinated ecosystem focused on data theft, resource hijacking, and destructive impact rather than a single standalone malware payload.
Aug 14, 2026