Cloud Atlas, an advanced persistent threat (APT), also known as Inception, has updated its attack arsenal with new tools which allow it to avoid detection through standard Indicators of Compromise. This updated infection chain has been spotted in the wild in different organizations in Eastern Europe, Central Asia and Russia.
Cloud Atlas is a threat actor that has a long history of cyber-espionage operations targeting industries, government agencies and other entities. It was first identified in 2014 and has been active ever since. Recently, Kaspersky researchers have seen Cloud Atlas targeting the international economics and aerospace industries as well as governmental and religious organizations in Portugal, Romania, Turkey, Ukraine, Russia, Turkmenistan, Afghanistan and Kyrgyzstan among other countries. Upon successful infiltration, Cloud Atlas would:
While Cloud Atlas hasn’t dramatically changed its tactics, since 2018, recent waves of attacks research has discovered it has started to implement a novel way of infecting its victims and conducts lateral movement through their network.
Fig.1: The infection chain that was used by Cloud Atlas before April 2019.
Previously, Cloud Atlas would first send a spear-phishing email with a malicious attachment to a target. In the case of a successful exploitation, PowerShower – the attached malware, used for initial reconnaissance and to download additional malicious modules – would then be executed to allow cyberattackers to proceed with an operation.
The newly updated chain of infection postpones the execution of PowerShower until a later stage; instead, after the initial infection, a malicious HTML app is now downloaded and executed on the target machine. This application will then collect initial information about the attacked computer, and downlo ..
Support the originator by clicking the read the rest link below.
