Skip to content
brandefense.io
Request A Demo
CybercrimeFinancial

TA516

TA516 is a cybercrime syndicate with a financial motive, tracked by Brandefense.

Also known as
  • SmokingDro
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Jan 1, 2016
Record updated

About TA516.

This actor typically distributes instances of the SmokeLoader intermediate downloader, which, in turn, downloads additional malware of the actor’s choice -- often banking Trojans. Figure 3 shows a lure document from a November campaign in which TA516 distributed fake resumes with malicious macros that, if enabled, launch a PowerShell script that downloads SmokeLoader. In this instance, we observed SmokeLoader downloading a Monero coinminer. Since the middle of 2017, TA516 has used similar macro-laden documents as well as malicious JavaScript hosted on Google Drive to distribute both Panda Banker and a coinminer executable via SmokeLoader, often in the same campaigns.

Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.