<ul><li>Cloud Atlas has been found to be using a previously undocumented toolset in which the group heavily used in 2024.</li><li>The group targets Eastern Europe and Central Asia mostly.</li><li>Victims get infected through phishing emails with a malicious document.</li><li>The HTA files in the document exploit vulnerabilities in formula editors to download and execute malware code.</li><li>After the download is complete, the malware adds a registry key to run an auto script 'VBShower Launcher'.</li><li>VBCloud, a new tool, is being used to steal data from the infected system.</li><li>VBCloud module duplicates the core functionality of VBShower and uses public cloud storage as C2 server.</li><li>The group uses PowerShell scripts to perform a range of tasks on the infected system.</li><li>Phishing emails continue to play an important role as an initial access point.</li><li>Cloud Atlas has been observed to attack victims in Russia, Belarus, Canada, Moldova, Israel, Kyrgyzstan, Vietnam, and Turkey.</li></ul>

Cloud Atlas seen using a new tool in its attacks

Discover more