Loading story…
Researchers attributed a sustained cyber-espionage campaign against government, diplomatic, and commercial organizations in Russia and Belarus to the Cloud Atlas APT group, linking activity seen through 2025 and into 2026 to phishing and stealthy remote-access operations. Initial access relied on phishing emails carrying ZIP archives with malicious .lnk files that launched external PowerShell scripts, while some intrusions also used older weaponized Office documents exploiting CVE-2018-0802.
Once inside victim networks, Cloud Atlas deployed an expanded toolset that included VBCloud for file theft, PowerShower for reconnaissance, lateral movement, Kerberoasting, credential theft, and UAC bypass, plus a newly identified PowerCloud utility. The operators also used reverse SSH tunnels, RevSocks, Tor, and public tools such as OpenSSH to maintain resilient backup command-and-control channels, and patched termsrv.dll to allow multiple concurrent RDP sessions without interrupting legitimate users. Researchers said the attribution was made with high confidence based on the group’s tooling, techniques, victim profile, and geographic focus, despite some limited infrastructure overlap with Head Mare.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
The activity continued into 2026, with tooling used for file theft, reconnaissance, lateral movement, Kerberoasting, credential theft, UAC bypass, and patching termsrv.dll to enable multiple concurrent RDP sessions without disrupting legitimate users. Telemetry indicated primary targeting of government and diplomatic entities in Russia and Belarus.
During the 2025-2026 campaign, the attackers used phishing emails with ZIP archives containing malicious LNK files that launched external PowerShell scripts, alongside older malicious Office documents exploiting CVE-2018-0802. These infection chains deployed tools including VBCloud, PowerShower, reverse SSH tunnels, Tor-based access, and the newly identified PowerCloud utility.
Researchers observed sustained SSH tunneling activity during 2025 targeting government and commercial organizations in Russia and Belarus. The activity used public tools such as OpenSSH, RevSocks, and Tor to maintain resilient command-and-control and backup access channels.
A November 2024 analysis described a phishing archive masquerading as a 1C-related file that executed a fake 1C:Enterprise window while extracting and decrypting a multi-stage payload. The malware installed SSH-based persistence, created a local user named 'config,' deployed a custom Go2Tunnel reverse-tunneling utility, and exposed associated hashes and IP indicators.
In its report, Securelist attributed part of the sustained SSH tunneling activity to the Cloud Atlas APT group with high confidence based on tooling, techniques, victimology, and geography. The researchers noted some infrastructure and directory overlaps with Head Mare activity but concluded the TTPs were distinct.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 114 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
securelist.ru
Open sourcebi.zone
Open sourcert-solar.ru
Open sourcet.me
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cloud Atlas advanced persistent threat group has intensified its operations in Eastern Europe and Central Asia, leveraging outdated Microsoft Office vulnerabilities, specifically CVE-2018-0802 in the Equation Editor, to compromise high-value targets. Attackers initiate their campaigns with phishing emails containing malicious Word documents, which, when opened, download remote templates that exploit the vulnerability. This infection chain results in the deployment of multiple backdoor implants, including VBShower, PowerShower, VBCloud, and CloudAtlas, enabling persistent access and data exfiltration from victim organizations. The group demonstrates advanced evasion and persistence techniques, with their malware components capable of executing additional payloads and communicating with command-and-control servers for further instructions. Recent technical analyses reveal that the infection process involves downloading and executing an HTML Application (HTA) file, which extracts several VBS files to disk as part of the VBShower backdoor. This backdoor acts as a launcher for subsequent implants, allowing the attackers to flexibly deploy new payloads and maintain control over compromised systems. The campaign observed in the first half of 2025 shows continuity with previous Cloud Atlas operations, but also includes refinements in their attack methodology and the use of previously undescribed implants. The group’s infrastructure restricts access to malicious files based on victim IP addresses and time windows, complicating detection and analysis efforts.
Jun 29, 2026
State-backed threat actor **Cloud Atlas** (also known as Inception) launched a cyberespionage campaign targeting Russian agricultural organizations by leveraging phishing emails disguised as official communications for an upcoming industry forum. The attackers distributed malicious files exploiting the eight-year-old Microsoft Office vulnerability `CVE-2017-11882`, enabling them to execute arbitrary code, compromise systems, install unauthorized software, manipulate data, and create new user accounts. This campaign was uncovered by Russian cybersecurity firm F6, which noted that the phishing lures were specifically crafted around the industry event to increase their effectiveness. Researchers observed that Cloud Atlas has intensified its operations against Russian and Belarusian targets in 2025, with indications that a defense enterprise was also among the recent victims. The group continues to rely on long-known vulnerabilities and established infection chains, suggesting that their attacks remain successful due to unpatched systems and human error. F6 highlighted that Cloud Atlas is refining its tools and experimenting with new payloads, but the persistent use of old exploits like `CVE-2017-11882` underscores the ongoing risk posed by poor cybersecurity hygiene in targeted organizations.
Jun 29, 2026
Earth Baku, a cluster linked to **APT41**, has expanded a long-running cyberespionage campaign against government and enterprise targets from the Indo-Pacific into **Europe** and the **Middle East and Africa**, using a steadily evolving malware arsenal and multiple intrusion paths. Trend Micro reported the group has compromised organizations in sectors including airlines, automotive, infrastructure, media, publishing, IT, and hardware, with activity tied to **SQL injection** on public-facing applications, exploitation of **Microsoft Exchange ProxyLogon** `CVE-2021-26855`, IIS server abuse, and web shells including **China Chopper** and **Godzilla**. Earlier reporting also described possible email-delivered LNK downloader chains and continued operational activity after public law-enforcement scrutiny. The operators have introduced **StealthReacher**, an upgraded loader derived from **StealthVector**, to deploy **SneakCross**, a modular backdoor assessed as the successor to **ScrambleCross** and earlier **Crosswalk**-related tooling. Across reporting, the group was observed using **Cobalt Strike Beacon**, **ShadowPad**, **Natwalk**, **RBRAT**, **Errorroot**, **HIGHNOON**, and other loaders and backdoors, while relying on stealth techniques such as ETW disabling, process and DLL hollowing, module stomping, CFG bypass, early-bird injection, and certificate bypass. Researchers also said Earth Baku hid command-and-control through CDN services, **Cloudflare Workers**, and **Google services**, and supported persistence, tunneling, and exfiltration with customized **iox**, **Rakshasa**, **Tailscale**, and **MEGAcmd**.
Aug 15, 2026