China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services

According to Positive Technologies researchers Daniil Grigoryan and Varvara Koloskova, the China-linked APT31 group has been attributed with a series of cyberattacks against the Russian information technology sector between 2024 and 2025, conducted while remaining undetected for extended periods. The attacks targeted companies in Russia that act as contractors and integrators for government agencies, amid a broader track record of activity across multiple sectors.

APT31 is said to rely on legitimate cloud services, notably Yandex Cloud, for command-and-control and data exfiltration in an effort to blend in with normal traffic and avoid detection. The group is also reported to have staged encrypted commands and payloads in social media profiles, while launching intrusions during weekends and holidays. In addition, the same report notes that APT31 exfiltrates data through Yandex’s cloud storage, enabling sustained access to victim networks over years.