APT Group Patches termsrv.dll to Enable Multiple RDP Sessions

Gbhackers •Mayura Kathir • May 25, 2026

A sustained cyber espionage campaign attributed to the Cloud Atlas advanced persistent threat (APT) group has introduced a stealthy technique that modifies the Windows termsrv.dll library to enable multiple Remote Desktop Protocol (RDP) sessions on compromised systems. Observed throughout 2025 and continuing into 2026, the activity primarily targets government and commercial entities in Russia and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cloud Atlas APT Group Exploits CVE-2018-0802 and Modifies termsrv.dll for RDP Access The Cloud Atlas APT group has been observed employing a sophisticated cyber espionage campaign targeting government and commercial entities in Russia and Belarus. This campaign, active since 2025 and continuing into 2026, utilizes a combination of phishing emails and exploits, notably the CVE-2018-0802 vulnerability in Microsoft Office. Attackers distribute ZIP files containing malicious LNK shortcuts that execute PowerShell scripts to establish persistence and deploy backdoors like VBCloud and PowerShower. A significant tactic involves modifying the termsrv.dll file to enable multiple simultaneous Remote Desktop Protocol (RDP) sessions, allowing attackers to operate undetected. The group also employs reverse SSH tunnels for command and control, enhancing their stealth. Current observations indicate ongoing activity with no signs of abatement. 4 sources 76

Extracted Entities

APT Group Patches termsrv.dll to Enable Multiple RDP Sessions

The full story

Extracted Entities

APT Groups (1)

Countries (1)

Industries (1)

MITRE ATT&CK (1)

Platforms (1)