Cloud Atlas: Analysis of Phishing Campaign and VBShower Backdoor
The article analyzes a phishing campaign by the Cloud Atlas APT group targeting Russian organizations. It details five successful attacks on the same system over time, using malicious Microsoft Office documents to deliver the VBShower backdoor. The attackers used alternate data streams to hide malicious code and maintained persistence through registry modifications. The analysis covers the evolution of the attack chain, including the use of VBCloud malware and various command and control servers. Despite prolonged access, no evidence of lateral movement was found. The report concludes that Cloud Atlas continues to be active, using consistent tactics and tools.
Pulse ID: 699c2539b33fbe17058937b3
Pulse Link: https://otx.alienvault.com/pulse/699c2539b33fbe17058937b3
Pulse Author: AlienVault
Created: 2026-02-23 10:00:25
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #Cloud #CloudAtlas #CyberSecurity #ICS #InfoSec #Malware #Microsoft #MicrosoftOffice #OTX #Office #OpenThreatExchange #Phishing #Russia #VBS #bot #AlienVault