In May 2024, Kaspersky's Global Research and Analysis Team (GReAT) uncovered a new advanced persistent threat (APT) group named CloudSorcerer. This sophisticated group has been actively targeting Russian government entities, leveraging cloud services such as Microsoft Graph, Yandex Cloud, and Dropbox for command-and-control (C2) and data exfiltration. CloudSorcerer's techniques echo the CloudWizard APT from 2023, utilizing GitHub and Mail.ru for initial communications and using encoded strings to interact with cloud services.
The malware used by CloudSorcerer is particularly notable for its ability to dynamically adapt its behaviour based on the process it runs in, highlighting its sophistication. The malware collects system information, manipulates files, executes shell commands, and creates processes using COM interfaces. These capabilities, combined with its use of cloud infrastructure for C2, underline the advanced nature of this cyber espionage toolset. Although there are similarities to CloudWizard, the distinct differences in code and functionality suggest that CloudSorcerer is a unique actor employing similar techniques but developing its tools.
#CloudSorcerer #APT #CyberSecurity #Kaspersky #RussianGovernment #CloudServices #MicrosoftGraph #YandexCloud #Dropbox #DataExfiltration #CyberEspionage #ThreatDetection #CyberThreats #GitHub #Malware #CommandAndControl #CyberAttack #InformationSecurity #CyberDefense #AdvancedThreats