Cloud Atlas activity in the first half of 2025: what changed

Known since 2014, the Cloud Atlas group targets countries in Eastern Europe and Central Asia, with infections typically delivered by phishing emails containing a malicious document that exploits an old vulnerability in the Microsoft Office Equation Editor to download and execute code. In the first half of 2025, Securelist reports that the group used an infection chain that culminates in implants including VBShower, VBCloud, PowerShower and CloudAtlas, each functioning as full backdoors.

The campaign relies on a DLL hijacking tactic where VLC Media Player acts as a loader, loading a malicious library from the local VLC path and decrypting a payload retrieved from a file named chambranle. CloudAtlas itself communicates with a cloud-based C2 via WebDAV, using a decrypted configuration to beacon system information and fetch further payloads, with FileGrabber among its commonly used plugins to exfiltrate files according to configurable rules.

Victims are identified as located in Russia and Belarus, spanning telecoms, construction, government entities and plants, with activity traceable back to the start of 2025. According to Securelist, the attackers continue to expand four implants and employ cloud services to manage backdoors.