Cloud Atlas Unleashes VBCloud Malware: Majority of Targets Located in Russia
December 27, 2024
Cyber Attack / Data Theft
Recent observations have revealed that the cyber threat group known as Cloud Atlas has deployed an emerging malware variant referred to as VBCloud in a series of targeted attacks throughout 2024. According to Kaspersky researcher Oleg Kupreev, these sophisticated operations have focused on several dozen users, with more than 80% of the affected parties based in Russia. The compromised systems are primarily infiltrated through deceptive phishing emails that contain malicious documents. These documents exploit an existing vulnerability within the formula editor (CVE-2018-0802) to download and execute the malicious code on the victims’ devices.
In addition to the significant number of Russian victims, reports indicate that a smaller collection of targets have been identified in countries such as Belarus, Canada, Moldova, Israel, Kyrgyzstan, Turkey, and Vietnam. Cloud Atlas, which has also been dubbed Clean Ursa, Inception, Oxygen, and Red October, is an unattributed cluster of threat activity that has been operational since 2014. This background suggests a level of sophistication and persistence that poses a serious risk to businesses globally.
In December 2022, the group was implicated in cyber operations targeting entities in Russia, Belarus, and Transnistria, employing a PowerShell-based backdoor named PowerShower. This history of aggressive tactics highlights their ongoing commitment to developing and deploying advanced malware strategies that bypass traditional security measures.
As organizations strive to enhance their cybersecurity posture, understanding the methods used by threat actors like Cloud Atlas is critical. The tactics associated with this recent attack correspond to several categories outlined in the MITRE ATT&CK framework. Initial access through phishing is a prominent tactic employed in this instance, facilitated by exploiting software vulnerabilities. Furthermore, the use of VBCloud may indicate potential methods for establishing persistence within networks, enabling attackers to maintain access and control over compromised systems.
The implications of this attack are significant for business owners, particularly those operating in regions with a high prevalence of such cyber threats. Organizations are advised to prioritize training employees on recognizing and responding to phishing attempts, as well as ensuring their software is regularly updated to patch known vulnerabilities.
Cybersecurity professionals must remain vigilant to the evolution of threats like VBCloud and apply frameworks such as MITRE ATT&CK when assessing their defenses. The ongoing activities of Cloud Atlas serve as a reminder that the landscape of cyber threats is ever-changing, necessitating a proactive approach to risk management and incident response.
