Skip to main content

Windows Defender thwarts major malware attack directed mostly at Russian users

On Thursday, March 8, Microsoft said that just before noon on Tuesday, Windows Defender blocked more than 80,000 instances of a massive malware attack that used a trojan called Dofoil, also known as Smoke Loader. Within the following 12 hours, Windows Defender blocked another 400,000 instances. Most of the smoky outbreak took place in Russia (73 percent) followed by Turkey (18 percent) and Ukraine (4 percent). 

Smoke Loader is a trojan that can retrieve a payload from a remote location once it infects a PC. It was last seen in a fake patch for the Meltdown and Spectre processor vulnerabilities, which downloaded various payloads for malicious purposes. But for the current outbreak in Russia and its neighboring countries, Smoke Loader’s payload was a cryptocurrency miner. 

“Because the value of Bitcoin and other cryptocurrencies continues to grow, malware operators see the opportunity to include coin mining components in their attacks,” Microsoft stated. “For example, exploit kits are now delivering coin miners instead of ransomware. Scammers are adding coin mining scripts in tech support scam websites. And certain banking trojan families added coin mining behavior.” 

Once on the PC, the Smoke Loader trojan launched a new instance of Explorer in Windows and placed it in a suspended state. The trojan then carved out a portion of the code used it to run in the system memory and filled that blank space with malware. After that, the malware could run undetected and delete the trojan components stored on the PC’s hard drive or SSD. 

Now disguised as the typical Explorer process running in the background, the malware launched a new instance of the Windows Update AutoUpdate Client service. Again, a section of the code was carved out, but coin mining malware filled the blank space instead. Windows Defender caught the miner red-handed because its Windows Update-based disguise ran from the wrong location. Network traffic stemming from this instance constituted highly suspicious activity as well. 

Because Smoke Loader needs an internet connection to receive remote commands, it relies on a command and control server located within the experimental, open-source Namecoin network infrastructure. According to Microsoft, this server tells the malware to sleep for a period of time, connect or disconnect to a specific IP address, download and execute a file from a specific IP address, and so on. 

“For coin miner malware, persistence is key. These types of malware employ various techniques to stay undetected for long periods of time in order to mine coins using stolen computer resources,” Microsoft says. That includes making a copy of itself and hiding out in the Roaming AppData folder and making another copy of itself to access IP addresses from the Temp folder. 

Microsoft says artificial intelligence and behavior-based detection helped thwart the Smoke Loader invasion but the company doesn’t state how victims received the malware. One possible method is the typical email campaign as seen with the recent fake Meltdown/Spectre patch, tricking recipients into downloading and installing/opening attachments.

Kevin Parrish
Former Digital Trends Contributor
Kevin started taking PCs apart in the 90s when Quake was on the way and his PC lacked the required components. Since then…
Best Surface Laptop and Surface Pro deals: From $450
Microsoft Surface Go 3 sitting on table.

If you want a thin and light laptop that's similar to the MacBook Air but not in the Apple ecosystem, then the Microsoft Surface lineup of laptops is absolutely the way to go. In fact, if you've seen the recent unwrapping of the business version of the Surface Pro 10 and Surface Laptop 6, you might be fired up and ready to grab your own surface. Unfortunately, the Surface lineup can be quite expensive, which is why we've gone out and scoured the retailers for the best deals we could find and collected them below. So, be sure to check out everything, as well as some of these other great laptop deals if you aren't fully committed to the Microsoft Surface lineup.
Microsoft Surface Go 3 -- $450, was $550

Functioning as a 2-in-1 laptop that can switch between tablet mode and laptop mode, the Microsoft Surface Go 3 won't have trouble dealing with basic tasks as it's equipped with the Intel Pentium Gold 6500Y processor and 8GB of RAM. The 10.5-inch touchscreen with 1920 x 1080 resolution is bright and colorful, and its 128GB SSD is more than enough for your documents. The Microsoft Surface Go 3 ships with Windows 11 Home in Mode, so you can start using it as soon as you unbox it. The device also promises up to 11 hours of battery life before requiring a recharge.

Read more
Best GPU deals: MSI, XFX, EVGA
An AMD graphics card in an external GPU enclosure.

If you're building a new PC from scratch, or upgrading an old one, then a new GPU is probably one of the biggest upgrades you can make, at least if you're looking for great gaming performance. Unfortunately, the last generation of RTX 40-series cards really amped the prices up, and even if you're going for AMD, you're going to be paying a pretty penny to get your hands on a good GPU. That said, there are some good deals to be had; whether you want something budget-friendly or high-end, you can always put that extra money you save into more RAM or a better CPU. Also, be sure to check out some of these gaming PC deals if you'd rather just grab something already pre-built.
MSI AMD Radeon RX 6500 XT Mech 2X 4GB GDDR6 -- $175, was $190

If you're looking for something that is ultra-budget, then this RX 6500 XT is a good option in the lower range and should let you handle at least some of the main free-to-play games like CS:GO and Rocket League, although you will have to play with graphical compromises. It should also handle indie and casual games, especially older ones like the ones you might find on emulators, so it's also a good option for that sort of budget build. the 4GB of VRAM is not a lot, but again, if you're not planning to play any modern AAA or AA games, then this isn't a bad option.

Read more
Horizon Forbidden West is a marvel — if your PC can handle the heat
Aloy shooting a bow in Horizon Forbidden West.

More than two years after its release on PS5, Horizon Forbidden West is now available on PC. The original game, Horizon Zero Dawn, has become a mainstay for performance testing on PC, and it's one of the pillars of our GPU reviews. The sequel ups the ante in a big way with more graphics options and a more demanding world overall.

I've been playing the game over the past week, drilling down on the best settings, comparing DLSS, FSR, and XeSS, and testing the bounds of performance. Horizon Forbidden West lives up to the standard set by the original release, though weaker GPUs with only 8GB of memory will struggle with high graphics settings and resolutions.
Best settings for Horizon Forbidden West PC

Read more