Loading threat actor…
CloudAtlas is a cyber-espionage threat actor active in the broader Russo-Ukrainian conflict region and associated with targeted intrusion activity against organizations and individuals in Eastern Europe, Central Asia, and Russia. The actor has been linked with moderate confidence to spear-phishing and email-based intrusion chains that use malicious Microsoft Word documents, remote templates, staged payload delivery, and infrastructure designed to spoof legitimate online services. Reported targeting has included scientists, researchers, and research scholars, including individuals connected to international military conferences, as well as victims in Russia through activity that mimicked known CloudAtlas tradecraft. Observed CloudAtlas-linked operations have relied on social-engineering lures, malicious Office documents, macro-enabled template abuse, and persistence through Microsoft Word startup templates. Later-stage malware in these campaigns used heavy obfuscation, anti-analysis and anti-sandbox checks, and network communications through cloud-hosted infrastructure. CloudAtlas has also been associated indirectly with deployment patterns involving the Owowa IIS backdoor in Russia through an email-based intrusion chain assessed to resemble the actor’s known methods. CloudAtlas is tracked as an espionage-oriented actor rather than a ransomware or extortion operation. Available reporting in this context supports overlap assessments and tradecraft similarities, but does not firmly establish broader aliasing or subgroup structure beyond the CloudAtlas name itself.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
1 malware family attributed to this actor across reporting.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as a known activity pattern whose email-based intrusion chain was mimicked by another campaign (GOFFEE) targeting Russia.
Referenced as a likely overlapping or related threat actor based on similar targeting, remote-template document delivery, abuse of cloud services, and Microsoft-spoofing domain patterns.
Mentioned only as background example of APT activity in the Russo-Ukrainian conflict region.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.