Back Technadu

Cloud Atlas APT Targets Russia and Belarus with PowerCloud Tool

Technadu • May 23, 2026

Researchers attributed a significant portion of Pervasive SSH tunnel activity targeting Russia and Belarus with cyberespionage to Cloud Atlas, an advanced persistent threat (APT) group tracked since 2014. In late 2025 and early 2026, the targeted industries primarily comprised government agencies and diplomatic entities in these regions.

To breach networks, Cloud Atlas utilizes phishing emails containing ZIP archives with LNK files. Additionally, the group leverages malicious documents designed to exploit CVE-2018-0802 , a vulnerability in the Microsoft Office Equation Editor process, a Kaspersky report says.

Following the initial compromise, the threat actors deploy established tools such as the VBCloud dropper and the PowerShower backdoor for persistence and reconnaissance.

During recent investigations, Kaspersky researchers identified a new tool in the Cloud Atlas arsenal named PowerCloud. This utility collects user data utilizing administrator privileges and subsequently writes this harvested information to Google Sheets encoded in Base64 format.

The group established redundant backup control channels using ReverseSocks, SSH, and Tor across many targeted campaigns over the year.

While Kaspersky noted specific infrastructure parallels between this campaign and recent Head Mare activity, such as the use of the PhantomHeart backdoor to create an SSH tunnel, researchers state that the underlying tactics, techniques, and procedures (TTPs) remain distinctly differentiated.

Kaspersky’s December 2025 analysis observed that the cyberespionage group started using the VBShower backdoor as the loader and VBCloud as a new module in their attacks.

April Democratic People's Republic of Korea (DPRK) cyber campaigns utilized malicious LNK files containing encoded PowerShell scripts to infiltrate systems and deploy decoy PDF documents.

In March, the pro-Ukrainian Bearlyfy Ransomware group attacked Russian companies .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cloud Atlas APT Targets Russia and Belarus with New Tools and Techniques Cloud Atlas, an advanced persistent threat group, has intensified its cyberespionage activities against government and commercial entities in Russia and Belarus since late 2025. The group employs phishing emails containing ZIP archives with malicious LNK files to initiate attacks, exploiting CVE-2018-0802 to execute malicious PowerShell scripts. Recent investigations revealed the introduction of a new tool called PowerCloud, which collects user data and sends it to Google Sheets. Established tools like the VBCloud dropper and PowerShower backdoor are also utilized for persistence and reconnaissance. The attackers have been observed using SSH tunnels and other utilities to maintain control over compromised systems. The ongoing campaigns have primarily targeted government agencies and diplomatic entities, raising significant concerns about national security. As of May 2026, these activities are still active and evolving. 2 sources 76

Extracted Entities

Cloud Atlas APT Targets Russia and Belarus with PowerCloud Tool

The full story

Extracted Entities

APT Groups (1)

Attack Types (3)

Countries (3)

CVEs (1)

Industries (1)

Malware (3)

MITRE ATT&CK (3)

Platforms (2)

Ransomware Groups (1)

Tools (5)