Cloud Atlas APT New Tools and Payloads

The Cloud Atlas APT group, active since 2014, has significantly updated its arsenal for campaigns spanning late 2025 into early 2026. Explicitly targeting government and diplomatic organizations in Russia and Belarus, the group utilizes phishing emails with malicious ZIP archives and LNK files to initiate multi-stage infections. Their technical evolution includes the deployment of a new PowerShell tool named PowerCloud, which exfiltrates system and administrative data to Google Sheets.

The group's infrastructure relies heavily on maintaining persistent, redundant access channels through third-party utilities like Tor, SSH, and RevSocks. By patching the Windows termsrv.dll to allow multi-user RDP sessions and using UAC bypasses via fodhelper.exe, the group maintains a high level of stealth. These methods allow them to operate simultaneously with legitimate users without detection, emphasizing their long-term focus on persistent espionage and data theft.

This activity demonstrates a sophisticated understanding of defense evasion, notably through the use of Volume Shadow Copies to bypass locked files like the SAM database and the modification of OpenSSH binaries to use custom DLL imports. Organizations in the targeted regions should prioritize monitoring for unauthorized PowerShell execution, modifications to system DLLs, and unusual outbound SSH or Tor traffic.