H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[SMOKEDHAM](https://attack.mitre.org/software/S0649) is a Powershell-based .NET backdoor that was first reported in May 2021; it has been used by at least one ransomware-as-a-service affiliate.(Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)

Labels

malware

21 recorded

Relationships

uses

to Additional Local or Domain Groups

Technique

uses

to Domain Fronting

Technique

uses

to Embedded Payloads

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Hidden Users

Technique

uses

to Ingress Tool Transfer

Technique

uses

Technique

uses

to Local Account

Technique

uses

to Local Account

Technique

uses

to Malicious Link

Technique

uses

to Modify Registry

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to Spearphishing Link

Technique

uses

to Standard Encoding

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Web Protocols

Technique

uses

Technique

4 external

References

mitre-attack

S0649

SMOKEDHAM

—

FireEye SMOKEDHAM June 2021

https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html

FireEye Shining A Light on DARKSIDE May 2021

https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html