Windows Defender Antivirus blocked more than 80,000 instances of several sophisticated trojans that exhibited advanced cross-process injection techniques, persistence mechanisms, and evasion methods. The trojans, which are new variants of Dofoil (also known as Smoke Loader), carry a coin miner payload. The cyberattack was made little before noon (PST) on March 6. Within the next 12 hours, more than 400,000 instances were recorded, 73% of which were in Russia, 18% in Turkey and 4% in Ukraine.