Cloud Atlas Adds Backdoors and Covert Access Tools in Russia and Belarus Campaigns
Summary
Kaspersky attributes campaigns targeting organizations in Russia and Belarus to Cloud Atlas with high confidence. Its investigation details phishing and malware chains, credential theft, and backup access through SSH tunnels, RevSocks, and Tor.
Key points
- The report describes Cloud Atlas activity targeting government, diplomatic, and commercial organizations in Russia and Belarus during late 2025 and early 2026.
- Phishing ZIP archives containing malicious LNK files launch PowerShell scripts; the group also uses malicious Office documents exploiting CVE-2018-0802.
- The Fixed.ps1 loader installs VBCloud, which can steal selected document files, and PowerShower, which supports reconnaissance, lateral movement, and Kerberoasting.
- A PowerShower credential-stealing script copies SAM and SECURITY files from a Volume Shadow Copy, using fodhelper.exe for a UAC bypass.
- Attackers use reverse SSH tunnels, RevSocks, and Tor Hidden Services as backup access channels; a separate script patches termsrv.dll to permit multiple RDP sessions.
- The newly analyzed PowerCloud tool collects administrator-related data and writes it to Google Sheets in Base64; a browser checker records whether browser processes are running.
Article Details
- Attack Vectors
- Phishing ZIP archives containing malicious LNK shortcuts launched PowerShell scripts hosted on external resources.
- Older infection chains used malicious Office documents exploiting CVE-2018-0802 in Microsoft Office Equation Editor.
- PowerShell loaders installed the VBCloud and PowerShower backdoors; PowerShower could download and execute additional scripts and conduct Kerberoasting.
- Attackers established reverse SSH tunnels and installed RevSocks and, in some cases, Tor Hidden Services for backup remote access and access to victim network segments.
- A PowerShower credential-stealing script copied SAM and SECURITY files from a Volume Shadow Copy, disguising them as PDFs; it used fodhelper.exe for a UAC bypass.
- A PowerShell script patched termsrv.dll to allow multiple concurrent RDP sessions and modified RDP firewall and security settings.
- PowerCloud collected administrator-related data and sent it to Google Sheets in Base64 format.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudguide[.]in | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| DOMAIN | goverru[.]com | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| DOMAIN | investika-club[.]com | Listed as PowerShell payload-staging infrastructure. |
| DOMAIN | istochnik[.]org | Listed as PowerShell payload-staging infrastructure. |
| DOMAIN | kufar[.]org | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| DOMAIN | onedrivesupport[.]net | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| DOMAIN | spbnews[.]net | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| DOMAIN | tenkoff[.]org | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| DOMAIN | ultimatecore[.]net | Listed as reverse SSH/SOCKS infrastructure used in the reported activity. |
| IPV4 | 185[.]126[.]239[.]77 | Listed as a PowerShell payload-staging server. |
| IPV4 | 185[.]22[.]154[.]73 | Listed as a PowerShell payload-staging server. |
| IPV4 | 185[.]53[.]179[.]136 | Listed as a PowerShell payload-staging server. |
| IPV4 | 194[.]102[.]104[.]207 | Listed as a PowerShell payload-staging server. |
| IPV4 | 194[.]87[.]196[.]163 | Listed as a PowerShell payload-staging server. |
| IPV4 | 195[.]58[.]49[.]9 | Listed as a PowerShell payload-staging server. |
| IPV4 | 37[.]228[.]129[.]224 | Listed as a PowerShell payload-staging server. |
| IPV4 | 45[.]87[.]219[.]116 | Listed as a PowerShell payload-staging server. |
| IPV4 | 46[.]17[.]44[.]125 | Listed as a PowerShell payload-staging server. |
| IPV4 | 46[.]17[.]44[.]212 | Listed as a PowerShell payload-staging server. |
| IPV4 | 46[.]17[.]45[.]49 | Listed as a PowerShell payload-staging server. |
| IPV4 | 46[.]17[.]45[.]56 | Listed as a PowerShell payload-staging server. |
| IPV4 | 5[.]181[.]21[.]75 | Listed as a PowerShell payload-staging server. |
| IPV4 | 93[.]125[.]114[.]193 | Listed as a PowerShell payload-staging server. |
| IPV4 | 93[.]125[.]114[.]57 | Listed as a PowerShell payload-staging server. |
| MD5 | 1a11b26dd0261ef27a112ce8b361c247 | Hash of the suspicious rdp_new.ps1 script that patched termsrv.dll to enable multiple RDP sessions. |
| MD5 | 2b4ba4facf8c299749771a3a4369782e | Hash listed in the ReverseSocks indicator section. |
| MD5 | 5329f7bff9d0d5db28821b86c26d628f | Hash of the PowerShell browser-checking script used to log running browser processes on infected hosts. |
| MD5 | ba9ce06641067742f2afc9691faff1dc | Hash listed with ReverseSocks-related files. |
| MD5 | fb0f8027acf1b1e47e07a63d8812ed50 | Hash listed with ReverseSocks-related files. |
MITRE ATT&CK
T1003.002 · Security Account ManagerA credential-stealing script copied the SAM file from a Volume Shadow Copy of the C: drive.T1021.001 · Remote Desktop ProtocolAttackers patched termsrv.dll to allow concurrent RDP sessions and used RDP to access compromised hosts.T1021.004 · SSHCompromised machines initiated outbound SSH connections to attacker-controlled servers for reverse tunnels.T1027 · Obfuscated Files or InformationThe VBCloud backdoor body was encrypted, and PowerCloud data was Base64-encoded.T1053.005 · Scheduled TaskThe attackers created a new Windows scheduled task to persist the reverse SSH tunnel.T1059.001 · PowerShellThe LNK shortcuts launched PowerShell scripts, which downloaded and executed additional scripts and payloads.T1059.005 · Visual BasicThe attackers ran VBS scripts to generate keys, start reverse SSH tunnels, and stop tunnels.T1070.004 · File DeletionThe infection script deleted rar.zip, *.pdf.zip, and *.pdf.lnk artifacts before launching the main payload.T1090.001 · Internal ProxyRevSocks and SSH tunnels provided proxy access to workstations and other segments of the victim network.T1105 · Ingress Tool TransferPowerShell scripts downloaded additional payloads, including the $temprar.zip archive and scripts from C2.T1204.002 · Malicious FileThe infection chain relied on a user opening the attached archive and executing its malicious LNK file.T1547.001 · Registry Run Keys / Startup FolderThe loader created a Run registry key named YandexBrowser_setup to launch $tempfixed.ps1 at startup.T1548.002 · Bypass User Account ControlA credential-stealing script used fodhelper.exe for a UAC bypass so PowerShell could run with elevated privileges.T1558.003 · KerberoastingPowerShower could conduct Kerberoasting to steal password hashes of Active Directory accounts.T1566.001 · Spearphishing AttachmentCloud Atlas emailed ZIP archives containing malicious LNK attachments to gain initial access.
CVE
Threat Actors
Cloud AtlasThe report attributes the described activity to Cloud Atlas with a high degree of confidence, including phishing, backdoor deployment, credential theft, and SSH, RevSocks, and Tor-based access.Head MareThe report says the PhantomHeart backdoor, attributed to Head Mare and used to create an SSH tunnel, was found in directories also used by Cloud Atlas; it notes that their TTPs remain differentiated.
Malware
PhantomHeartThe PhantomHeart backdoor (available in Russian only), attributed to Head Mare and used to create an SSH tunnel, was placed in directories actively used by Cloud Atlas:PowerShowerThe campaign added VBCloud, PowerShower, RevSocks, Tor, and PowerCloud to support theft, reconnaissance, persistence, and covert remote access.VBCloudThe campaign added VBCloud, PowerShower, RevSocks, Tor, and PowerCloud to support theft, reconnaissance, persistence, and covert remote access.
Vendors
GooglePowerCloud exfiltrated administrator-related data to Google Sheets in Base64 format, while a browser-checking script logged active browsers to determine user presence.MicrosoftThe group also used older malicious document infection chains leveraging CVE-2018-0802 in Microsoft Office Equation Editor.
Products
Google SheetsPowerCloud exfiltrated administrator-related data to Google Sheets in Base64 format, while a browser-checking script logged active browsers to determine user presence.Microsoft OfficeThe group also used older malicious document infection chains leveraging CVE-2018-0802 in Microsoft Office Equation Editor.Microsoft Windows[T1021.001 ] Remote Services: Remote Desktop Protocol – Attackers enabled and abused RDP for interactive access (‘allow multiple RDP sessions in Windows 10’).
Tools
OpenSSHPatched OpenSSHPAExec[T1059.005 ] Command and Scripting Interpreter: Visual Basic – VBScript was used for tunnel setup and execution (‘run VBS scripts via PAExec or PsExec’).PowerCloudThe campaign added VBCloud, PowerShower, RevSocks, Tor, and PowerCloud to support theft, reconnaissance, persistence, and covert remote access.PS2EXEIn most cases, it is packaged into an executable file using the PS2EXE utility, but we have also encountered variants in the form of a separate PowerShell script.PsExec[T1059.005 ] Command and Scripting Interpreter: Visual Basic – VBScript was used for tunnel setup and execution (‘run VBS scripts via PAExec or PsExec’).revsocksThe campaign added VBCloud, PowerShower, RevSocks, Tor, and PowerCloud to support theft, reconnaissance, persistence, and covert remote access.TorThe campaign added VBCloud, PowerShower, RevSocks, Tor, and PowerCloud to support theft, reconnaissance, persistence, and covert remote access.
Countries
BelarusSSH tunnel activity through 2025 into 2026 against government and commercial targets in Russia and Belarus, using phishing archives, malicious LNK files, PowerShell loaders, and multiple backup access tools.Russiawidespread SSH tunnel activity through 2025 into 2026 against government and commercial targets in Russia and Belarus, using phishing archives, malicious LNK files, PowerShell loaders, and multiple backup access
Industries
DiplomaticThe targeted industries mostly include government agencies and diplomatic entities.GovernmentCloud Atlas conducted widespread SSH tunnel activity through 2025 into 2026 against government and commercial targets in Russia and Belarus, using phishing archives, malicious LNK files, PowerShell loaders, and multiple