LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0649: SMOKEDHAM

SMOKEDHAM is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.[1][2]

EnterpriseS0649MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

SMOKEDHAM matters because it represents a Windows PowerShell/.NET backdoor with behavior that spans execution, persistence, discovery, credential collection, command-and-control, tool transfer, and exfiltration patterns. MITRE notes it has been used by at least one ransomware-as-a-service affiliate, so the defensive value is less about a single malware name and more about validating whether the organization can see and contain a PowerShell-enabled intrusion path before it supports data theft, persistence, or ransomware follow-on activity.

Executive priority

Treat SMOKEDHAM as a test case for ransomware-readiness and Windows endpoint visibility. Leaders should ask whether security teams can prove coverage for suspicious PowerShell activity, registry-based persistence, local account and group changes, user discovery, screen/keylogging-style collection indicators, and web-based C2/exfiltration. The priority is business resilience: if these behaviors are not logged, retained, and triaged reliably, incident responders may struggle to determine scope, credential exposure, and whether data left the environment.

Technical view

ATT&CK does not provide object-specific detection guidance for SMOKEDHAM, but the relationship set gives clear validation targets. SOC and IR teams should focus on Windows telemetry for PowerShell execution, .NET/script artifacts, embedded payload patterns, registry modification and Run Key persistence, local account creation or group membership changes, system/user discovery commands, and outbound web traffic consistent with C2, web services, domain fronting, standard encoding, symmetric encryption, ingress tool transfer, or exfiltration over the C2 channel. Because the object is described as a PowerShell-based .NET backdoor, endpoint process, script, registry, identity, and network evidence should be correlated rather than reviewed in isolation.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry, especially PowerShell and child processes
  • PowerShell script block, module, and transcript logging where enabled
  • Windows Registry auditing for Run Keys, startup locations, and other persistence-related modifications
  • Local account creation, local/domain group membership changes, and hidden or unusual account indicators
  • Authentication and identity logs tied to newly created or modified accounts

Detection direction

  • Validate that PowerShell logging is enabled, centrally collected, and retained long enough to support ransomware investigations.
  • Tune detections around suspicious PowerShell execution chains, encoded content, unusual .NET loading, embedded payload behavior, and PowerShell launching network or persistence actions.
  • Correlate registry Run Key/startup changes with the creating process and user context; avoid treating registry alerts as standalone evidence.
  • Monitor local account creation and group additions, especially when paired with PowerShell, registry changes, or remote access activity.
  • Review outbound web traffic for mismatches or anomalies consistent with web protocols, web services, domain fronting, encoded payloads, or encrypted C2; account for high false-positive potential from normal SaaS/CDN traffic.

Mitigation priorities

  • Prioritize PowerShell hardening and monitoring on Windows systems, including reducing unnecessary script execution and improving logging visibility.
  • Restrict and monitor local administrator rights, local account creation, and group membership changes to reduce persistence and privilege-escalation opportunities.
  • Harden registry persistence locations through least privilege, change monitoring, and response playbooks for suspicious Run Key/startup modifications.
  • Control egress paths and inspect web proxy/DNS/TLS metadata where appropriate to improve visibility into web-based C2 and exfiltration patterns.
  • Strengthen phishing-link resilience with user reporting, email/web filtering, and rapid investigation workflows, since related behavior includes malicious and spearphishing links.
Additional notes and limits

The official object identifies SMOKEDHAM as a PowerShell-based .NET backdoor first reported in May 2021 and cites FireEye reporting, including use by at least one ransomware-as-a-service affiliate. ATT&CK tactics are not specified for the malware object itself, so practical guidance is derived from the supplied technique relationships. The strongest defensive use is as a coverage review across Windows endpoint monitoring, identity change auditing, persistence detection, and web-based C2/exfiltration visibility.

No official detection text, aliases, labels, or object-level tactics were supplied. Several related techniques list platforms beyond Windows, but the SMOKEDHAM object itself is supplied only with Windows as its platform; platform conclusions should therefore remain Windows-focused. Local environment baselines, logging configuration, retention, and EDR/proxy capabilities are required to determine actual detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

SMOKEDHAM

SMOKEDHAM is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

21 rows
DomainIDNameRelationship / procedure
EnterpriseT1573.001Symmetric CryptographySub-technique

SMOKEDHAM has encrypted its C2 traffic with RC4.[2]

EnterpriseT1564.002Hidden UsersSub-technique

SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen. [2]

EnterpriseT1132.001Standard EncodingSub-technique

SMOKEDHAM has encoded its C2 traffic with Base64.[2]

EnterpriseT1136.001Local AccountSub-technique

SMOKEDHAM has created user accounts.[2]

EnterpriseT1112Modify Registry

SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.[2]

EnterpriseT1098.007Additional Local or Domain GroupsSub-technique

SMOKEDHAM has added user accounts to local Admin groups.[2]

EnterpriseT1105Ingress Tool Transfer

SMOKEDHAM has used Powershell to download UltraVNC and ngrok from third-party file sharing sites.[2]

EnterpriseT1102Web Service

SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.[1]

EnterpriseT1082System Information Discovery

SMOKEDHAM has used the systeminfo command on a compromised host.[2]

EnterpriseT1204.001Malicious LinkSub-technique

SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.[2]

EnterpriseT1056.001KeyloggingSub-technique

SMOKEDHAM can continuously capture keystrokes.[1][2]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

SMOKEDHAM has used reg.exe to create a Registry Run key.[2]

EnterpriseT1033System Owner/User Discovery

SMOKEDHAM has used whoami commands to identify system owners.[2]

EnterpriseT1598.003Spearphishing LinkSub-technique

SMOKEDHAM has been delivered via malicious links in phishing emails.[1]

EnterpriseT1041Exfiltration Over C2 Channel

SMOKEDHAM has exfiltrated data to its C2 server.[2]

EnterpriseT1027.009Embedded PayloadsSub-technique

The SMOKEDHAM source code is embedded in the dropper as an encrypted string.[2]

EnterpriseT1113Screen Capture

SMOKEDHAM can capture screenshots of the victim’s desktop.[1][2]

EnterpriseT1059.001PowerShellSub-technique

SMOKEDHAM can execute Powershell commands sent from its C2 server.[2]

EnterpriseT1087.001Local AccountSub-technique

SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.[2]

EnterpriseT1090.004Domain FrontingSub-technique

SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.[2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1564.002: Hidden UsersEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1136.001: Local AccountEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1098.007: Additional Local or Domain GroupsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1598.003: Spearphishing LinkEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1027.009: Embedded PayloadsEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1090.004: Domain FrontingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
a9248c5057ce35d5...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundlea9248c5057ce…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  2. [2]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  3. [3]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  4. [4]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  5. [5]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  6. [6]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  7. [7]
    SMOKEDHAM

    (Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)

  8. [8]
    SMOKEDHAM

    (Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)

  9. [9]
    SMOKEDHAM

    (Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)

  10. [10]
    mitre-attackS0649
    Open source URL
  11. [11]
    mitre-attackS0649
    Open source URL
  12. [12]
    mitre-attackS0649
    Open source URL
  13. [13]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  14. [14]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  15. [15]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  16. [16]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  17. [17]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  18. [18]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  19. [19]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  20. [20]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  21. [21]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  22. [22]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  23. [23]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  24. [24]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  25. [25]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  26. [26]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  27. [27]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  28. [28]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  29. [29]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  30. [30]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  31. [31]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  32. [32]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  33. [33]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  34. [34]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  35. [35]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  36. [36]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  37. [37]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  38. [38]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  39. [39]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  40. [40]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  41. [41]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  42. [42]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  43. [43]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  44. [44]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  45. [45]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  46. [46]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  47. [47]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  48. [48]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  49. [49]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  50. [50]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  51. [51]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  52. [52]
    FireEye Shining A Light on DARKSIDE May 2021

    FireEye. (2021, May 11). Shining a Light on DARKSIDE Ransomware Operations. Retrieved September 22, 2021.

    Open source URL
  53. [53]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  54. [54]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  55. [55]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
  56. [56]
    FireEye SMOKEDHAM June 2021

    FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use