Federal Charges Filed Against Alleged SmokeLoader Malware Operator in Vermont

An alleged operator of the SmokeLoader malware, identified as Nicholas Moses (alias “scrublord”), is facing federal hacking charges in Vermont. The charges stem from accusations that he stole personal data from over 65,000 victims, including an FDIC-insured financial institution. The case highlights the persistent threat posed by modular malware and the growing collaboration between international law enforcement agencies.

Case Overview and Charges

The U.S. Department of Justice has charged Moses with conspiracy to commit computer fraud, alleging he operated a Netherlands-based command-and-control (C2) server between January 2022 and May 2023. According to court documents, Moses sold stolen credentials for $1–$5 each and claimed access to more than 500,000 “stealer logs.” A screenshot of his database revealed 619,763 files containing victim data, underscoring the scale of the operation.

SmokeLoader, a malware strain active since 2011, is known for its modular capabilities, including loading additional payloads, stealing information, conducting DDoS attacks, and logging keystrokes. It has been linked to Russian cybercriminals and attacks on Ukrainian entities, as noted in a technical analysis by Cyfirma.

Law Enforcement Actions and Global Impact

The arrest is part of a broader effort by Europol’s Operation Endgame (2024–2025), which targeted major malware droppers like IcedID, Pikabot, and SmokeLoader. The operation resulted in five arrests linked to SmokeLoader’s pay-per-install service, including an individual known as “Superstar.” Raids were conducted in Canada, Denmark, France, Germany, and the U.S., demonstrating the global reach of the investigation.

This case is significant for its emphasis on cross-border collaboration. The U.S. and Europol worked together to dismantle the infrastructure supporting SmokeLoader, which had been a persistent threat due to its adaptability and low cost ($400–$1,650 on underground forums).

Technical Analysis of SmokeLoader

SmokeLoader’s modular design allows it to function as a loader, infostealer, DDoS tool, and keylogger. Its longevity in the cybercrime ecosystem is attributed to its affordability and flexibility. Below is a breakdown of its key components:

Component	Function
Loader	Deploys additional malware payloads
Infostealer	Harvests credentials and sensitive data
DDoS Module	Launches distributed denial-of-service attacks
Keylogger	Records keystrokes for credential theft

Relevance to Security Professionals

For security teams, SmokeLoader’s modularity poses a significant challenge. Its ability to evade detection and deliver multiple payloads makes it a preferred tool for cybercriminals. Organizations should prioritize:

Endpoint security solutions with behavioral analysis
Credential hygiene, including multi-factor authentication (MFA)
Network monitoring for unusual C2 traffic patterns

Red teams can use SmokeLoader’s tactics as a case study for simulating advanced persistent threats (APTs), while blue teams should focus on detecting its signature behaviors, such as unusual process injection and C2 communication.

Conclusion

The federal charges against Nicholas Moses mark a milestone in the fight against SmokeLoader, but the malware’s modular nature ensures it will remain a threat. The case underscores the importance of international cooperation in combating cybercrime and serves as a reminder for organizations to bolster their defenses against credential theft and malware infections.