CloudAtlas

CloudAtlas is a Windows backdoor associated with the Cloud Atlas APT group, which has targeted organizations in Eastern Europe and Central Asia, including entities in Russia and Belarus across sectors such as government, telecommunications, construction, and industry. The malware is part of a broader multi-stage intrusion chain that commonly begins with phishing emails carrying malicious Microsoft Office documents exploiting CVE-2018-0802. Subsequent stages use HTA, VBS, and PowerShell components, including VBShower and PowerShower, to install additional implants.

CloudAtlas is deployed through DLL sideloading using a legitimate VLC application as a loader for an encrypted payload. It communicates with command-and-control infrastructure over WebDAV and abuses public cloud services for command-and-control operations, a design choice that complicates detection and disruption. The backdoor is modular and can retrieve executable DLL plugins that extend functionality.

Documented plugin capabilities include file theft, arbitrary command execution, browser password theft from Chromium-based browsers, and host information collection. Related reporting also describes the Cloud Atlas toolset as supporting reconnaissance, credential theft, and exfiltration through overlapping implants such as VBCloud and PowerShower. CloudAtlas uses encrypted payloads and configuration data and is part of a long-running, evolving espionage-oriented malware ecosystem maintained by the Cloud Atlas threat actor.