Loading story…
The Cloud Atlas advanced persistent threat group has intensified its operations in Eastern Europe and Central Asia, leveraging outdated Microsoft Office vulnerabilities, specifically CVE-2018-0802 in the Equation Editor, to compromise high-value targets. Attackers initiate their campaigns with phishing emails containing malicious Word documents, which, when opened, download remote templates that exploit the vulnerability. This infection chain results in the deployment of multiple backdoor implants, including VBShower, PowerShower, VBCloud, and CloudAtlas, enabling persistent access and data exfiltration from victim organizations. The group demonstrates advanced evasion and persistence techniques, with their malware components capable of executing additional payloads and communicating with command-and-control servers for further instructions.
Recent technical analyses reveal that the infection process involves downloading and executing an HTML Application (HTA) file, which extracts several VBS files to disk as part of the VBShower backdoor. This backdoor acts as a launcher for subsequent implants, allowing the attackers to flexibly deploy new payloads and maintain control over compromised systems. The campaign observed in the first half of 2025 shows continuity with previous Cloud Atlas operations, but also includes refinements in their attack methodology and the use of previously undescribed implants. The group’s infrastructure restricts access to malicious files based on victim IP addresses and time windows, complicating detection and analysis efforts.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Kaspersky published a detailed analysis of Cloud Atlas activity in the first half of 2025, describing its modular malware, DLL hijacking via VLC Media Player, scheduled-task persistence, and use of cloud services for command and control. The report also released indicators of compromise such as file hashes and malicious domains to support detection and response.
During the H1 2025 campaign, Cloud Atlas sent phishing emails with malicious Microsoft Office documents exploiting CVE-2018-0802. The infection chain deployed backdoors including VBShower, PowerShower, VBCloud, and CloudAtlas, enabling persistence, reconnaissance, credential theft, command execution, and data exfiltration.
In the first half of 2025, the Cloud Atlas APT group continued targeting organizations in Eastern Europe and Central Asia, with reported focus on Russia and Belarus. Victims spanned telecommunications, construction, government, and industrial sectors.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 50 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers attributed a sustained cyber-espionage campaign against government, diplomatic, and commercial organizations in Russia and Belarus to the **Cloud Atlas** APT group, linking activity seen through 2025 and into 2026 to phishing and stealthy remote-access operations. Initial access relied on phishing emails carrying ZIP archives with malicious `.lnk` files that launched external PowerShell scripts, while some intrusions also used older weaponized Office documents exploiting `CVE-2018-0802`. Once inside victim networks, Cloud Atlas deployed an expanded toolset that included **VBCloud** for file theft, **PowerShower** for reconnaissance, lateral movement, Kerberoasting, credential theft, and UAC bypass, plus a newly identified **PowerCloud** utility. The operators also used reverse SSH tunnels, **RevSocks**, **Tor**, and public tools such as **OpenSSH** to maintain resilient backup command-and-control channels, and patched `termsrv.dll` to allow multiple concurrent RDP sessions without interrupting legitimate users. Researchers said the attribution was made with high confidence based on the group’s tooling, techniques, victim profile, and geographic focus, despite some limited infrastructure overlap with **Head Mare**.
Jun 29, 2026
State-backed threat actor **Cloud Atlas** (also known as Inception) launched a cyberespionage campaign targeting Russian agricultural organizations by leveraging phishing emails disguised as official communications for an upcoming industry forum. The attackers distributed malicious files exploiting the eight-year-old Microsoft Office vulnerability `CVE-2017-11882`, enabling them to execute arbitrary code, compromise systems, install unauthorized software, manipulate data, and create new user accounts. This campaign was uncovered by Russian cybersecurity firm F6, which noted that the phishing lures were specifically crafted around the industry event to increase their effectiveness. Researchers observed that Cloud Atlas has intensified its operations against Russian and Belarusian targets in 2025, with indications that a defense enterprise was also among the recent victims. The group continues to rely on long-known vulnerabilities and established infection chains, suggesting that their attacks remain successful due to unpatched systems and human error. F6 highlighted that Cloud Atlas is refining its tools and experimenting with new payloads, but the persistent use of old exploits like `CVE-2017-11882` underscores the ongoing risk posed by poor cybersecurity hygiene in targeted organizations.
Jun 29, 2026
Multiple early-2026 campaigns highlight increasingly **low-noise initial access** and **living-off-the-land** execution on Windows endpoints. CyStack reported activity attributed to **APT-Q-27 (GoldenEyeDog)** targeting financial institutions via a corporate support workflow: a user clicked a malicious link delivered through a **Zendesk ticket**, leading to download of an executable masquerading as an image/`.pif` file (aided by Windows’ hidden-extension defaults). The malware was signed with a **revoked certificate** that still appeared trusted due to a valid timestamp, and its modular backdoor/C2 infrastructure overlapped with prior APT-Q-27 activity, enabling stealthy persistence and control without triggering common endpoint alerts. Separately, Securonix described the **Dead#Vax** multistage campaign using phishing links to **VHD files hosted on IPFS**, where mounting/opening the VHD triggers **Windows Script Files**, obfuscated batch, and **PowerShell** loaders to support encrypted data theft and conceal execution logic, culminating in **AsyncRAT** deployment for credential theft, surveillance, and follow-on intrusion. In another targeted operation, Zscaler ThreatLabz linked **Operation Neusploit** to **APT28**, exploiting **CVE-2026-21509** (Microsoft Office/365 **OLE** bypass) via crafted **RTF** documents to drop payloads including **MiniDoor** (Outlook-focused collection and mailbox manipulation, including exfiltration to attacker-controlled email accounts) and **PixyNetLoader** (reported to use steganography). A separate “ThreatsDay” bulletin is a multi-story roundup and does not provide additional, specific corroboration on these same campaigns beyond mentioning adjacent themes (e.g., AsyncRAT/C2) in a broader news digest.
Jun 29, 2026