APT / THREAT GROUP

Sasfis

aliases

Last seen:Mar 17, 2026

Intelligence Profile

Sasfis acts mostly as a downloader that has been observed to download Asprox and FakeAV. According to a VirusBulletin article from 2012, it is likely authored by the same group as SmokeLoader.

Threat Analysis

Sasfis is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://blog.trendmicro.com/trendlabs-security-intelligence/sasfis-malware-uses-a-new-trick/

→https://www.symantec.com/security-center/writeup/2010-020210-5440-99

→https://isc.sans.edu/forums/diary/Sasfis+Propagation/8860/

→https://blog.trendmicro.com/trendlabs-security-intelligence/sasfis-fizzles-in-the-background/

→https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/sasfis

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

Sasfiswin.sasfisOficla

External Intelligence

Malpedia: win.sasfis

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Sasfis