{"id":211,"date":"2025-12-19T10:00:52","date_gmt":"2025-12-19T10:00:52","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/cloud-atlas-activity-in-the-first-half-of-2025-what-changed\/"},"modified":"2025-12-19T10:00:52","modified_gmt":"2025-12-19T10:00:52","slug":"cloud-atlas-activity-in-the-first-half-of-2025-what-changed","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/cloud-atlas-activity-in-the-first-half-of-2025-what-changed\/","title":{"rendered":"Cloud Atlas activity in the first half of 2025: what changed"},"content":{"rendered":"
\n

\"\"<\/p>\n

Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia. Infections occur via phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor process (CVE-2018-0802<\/a>) to download and execute malicious code. In this report, we describe the infection chain and tools that the group used in the first half of 2025, with particular focus on previously undescribed implants.<\/p>\n

Additional information about this threat, including indicators of compromise, is available to customers of the Kaspersky Intelligence Reporting Service<\/a>. Contact: intelreports@kaspersky.com<\/a>.<\/p>\n

Technical details<\/h2>\n

Initial infection<\/h3>\n

The starting point is typically a phishing email with a malicious DOC(X) attachment. When the document is opened, a malicious template is downloaded from a remote server. The document has the form of an RTF file containing an exploit for the formula editor, which downloads and executes an HTML Application (HTA) file.
\nFpaylo\n<\/p>\n

\"Malicious<\/a><\/p>\n

Malicious template with the exploit loaded by Word when opening the document<\/p>\n<\/div>\n

We were unable to obtain the actual RTF template with the exploit. We assume that after a successful infection of the victim, the link to this file becomes inaccessible. In the given example, the malicious RTF file containing the exploit was downloaded from the URL hxxps:\/\/securemodem[.]com?tzak.html_anacid<\/code>.<\/p>\n

Template files, like HTA files, are located on servers controlled by the group, and their downloading is limited both in time and by the IP addresses of the victims. The malicious HTA file extracts and creates several VBS files on disk that are parts of the VBShower backdoor. VBShower then downloads and installs other backdoors: PowerShower, VBCloud, and CloudAtlas.<\/p>\n

This infection chain largely follows the one previously seen in Cloud Atlas\u2019 2024 attacks<\/a>. The currently employed chain is presented below:<\/p>\n

\"Malware<\/a><\/p>\n

Malware execution flow<\/p>\n<\/div>\n

Several implants remain the same, with insignificant changes in file names, and so on. You can find more details in our previous article on the following implants:<\/p>\n