Mentioned as operator of SmokeLoader in CrowdStrike's 2020 Report.
No exploited CVEs have been attributed to this threat actor yet.