Loading story…
State-backed threat actor Cloud Atlas (also known as Inception) launched a cyberespionage campaign targeting Russian agricultural organizations by leveraging phishing emails disguised as official communications for an upcoming industry forum. The attackers distributed malicious files exploiting the eight-year-old Microsoft Office vulnerability CVE-2017-11882, enabling them to execute arbitrary code, compromise systems, install unauthorized software, manipulate data, and create new user accounts. This campaign was uncovered by Russian cybersecurity firm F6, which noted that the phishing lures were specifically crafted around the industry event to increase their effectiveness.
Researchers observed that Cloud Atlas has intensified its operations against Russian and Belarusian targets in 2025, with indications that a defense enterprise was also among the recent victims. The group continues to rely on long-known vulnerabilities and established infection chains, suggesting that their attacks remain successful due to unpatched systems and human error. F6 highlighted that Cloud Atlas is refining its tools and experimenting with new payloads, but the persistent use of old exploits like CVE-2017-11882 underscores the ongoing risk posed by poor cybersecurity hygiene in targeted organizations.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
Ahead of an upcoming industry forum in Moscow, Cloud Atlas targeted Russia's agricultural sector with phishing emails themed around the event and exploited CVE-2017-11882 to deliver malicious payloads.
The reported campaign was described as the second recent Cloud Atlas attack against Russian agro-industrial companies, indicating at least one prior 2025 operation against the sector.
Researchers observed heightened Cloud Atlas activity during 2025, including campaigns targeting agricultural and defense enterprises in Russia and Belarus.
Researchers describe Cloud Atlas, also known as Inception, as an espionage group that has been active since at least 2014, using phishing, custom malware loaders, and encrypted communications for data exfiltration.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cloud Atlas advanced persistent threat group has intensified its operations in Eastern Europe and Central Asia, leveraging outdated Microsoft Office vulnerabilities, specifically CVE-2018-0802 in the Equation Editor, to compromise high-value targets. Attackers initiate their campaigns with phishing emails containing malicious Word documents, which, when opened, download remote templates that exploit the vulnerability. This infection chain results in the deployment of multiple backdoor implants, including VBShower, PowerShower, VBCloud, and CloudAtlas, enabling persistent access and data exfiltration from victim organizations. The group demonstrates advanced evasion and persistence techniques, with their malware components capable of executing additional payloads and communicating with command-and-control servers for further instructions. Recent technical analyses reveal that the infection process involves downloading and executing an HTML Application (HTA) file, which extracts several VBS files to disk as part of the VBShower backdoor. This backdoor acts as a launcher for subsequent implants, allowing the attackers to flexibly deploy new payloads and maintain control over compromised systems. The campaign observed in the first half of 2025 shows continuity with previous Cloud Atlas operations, but also includes refinements in their attack methodology and the use of previously undescribed implants. The group’s infrastructure restricts access to malicious files based on victim IP addresses and time windows, complicating detection and analysis efforts.
Jun 29, 2026
Researchers attributed a sustained cyber-espionage campaign against government, diplomatic, and commercial organizations in Russia and Belarus to the **Cloud Atlas** APT group, linking activity seen through 2025 and into 2026 to phishing and stealthy remote-access operations. Initial access relied on phishing emails carrying ZIP archives with malicious `.lnk` files that launched external PowerShell scripts, while some intrusions also used older weaponized Office documents exploiting `CVE-2018-0802`. Once inside victim networks, Cloud Atlas deployed an expanded toolset that included **VBCloud** for file theft, **PowerShower** for reconnaissance, lateral movement, Kerberoasting, credential theft, and UAC bypass, plus a newly identified **PowerCloud** utility. The operators also used reverse SSH tunnels, **RevSocks**, **Tor**, and public tools such as **OpenSSH** to maintain resilient backup command-and-control channels, and patched `termsrv.dll` to allow multiple concurrent RDP sessions without interrupting legitimate users. Researchers said the attribution was made with high confidence based on the group’s tooling, techniques, victim profile, and geographic focus, despite some limited infrastructure overlap with **Head Mare**.
Jun 29, 2026
A financially motivated cybercrime group has launched Operation FrostBeacon, a sophisticated malware campaign targeting business-to-business (B2B) enterprises across the Russian Federation. The attackers use a dual infection strategy: one method involves phishing emails containing archive files with malicious LNK shortcuts disguised as PDF documents, which, when executed, trigger hidden PowerShell commands to download further payloads. The second method exploits unpatched legacy vulnerabilities, specifically CVE-2017-0199 and CVE-2017-11882, embedded in malicious DOCX and RTF documents. Both infection chains ultimately execute a remote HTML Application (HTA) file, which launches an obfuscated PowerShell loader to deploy Cobalt Strike beacons, granting persistent access to compromised networks. The campaign primarily targets legal, finance, logistics, industrial production, construction, and technical departments within Russian B2B organizations. Attackers leverage Russian-controlled domains for command-and-control infrastructure and employ customized Cobalt Strike malleable profiles to evade detection. Seqrite Labs reports that over 20 initial infection files have been observed, with multiple infection chains and infrastructure components identified in the wild. The operation demonstrates a high level of technical sophistication and persistence, posing a significant threat to Russian corporate environments reliant on outdated security postures.
Jun 29, 2026