Cloud Atlas
Also known asInception · Oxygen · Inception Framework · ATK 116 · Blue Odin · Clean Ursa
Summary
Long-running espionage actor active since 2014, historically targeting post-Soviet states. November 2024: Positive Technologies identified new Cloud Atlas attacks against Russian military-industrial complex enterprises with updated network infrastructure. Malicious files appeared January 2025, with servers/domains/TLS certs registered October-November 2024. Uses cloud storage services and malicious HTML attachments with embedded VBA macros. Kaspersky, which named both, assessed in 2014 that Cloud Atlas "represents a rebirth of the RedOctober attacks"; the link is an assessment, never confirmed, so Red October is recorded as a predecessor rather than an alias. Kaspersky and Positive Technologies both track this group independently with overlapping indicators.
Attribution
No public state attribution
Tracked by researchers; no state or organisation has been publicly attributed.
- Kaspersky GReAT (Research, 2014-12-10)
A rebirth of Red October; no state named - Kaspersky (Research, 2026-05-22)
Current victims in Russia and Belarus
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Russia/Belarus government and diplomatic targeting — LNK archives, SSH/RevSocks/Tor tunnels, PowerCloud (H2 2025 – early 2026) | 2025-07 – 2026 | Russia, Belarus | Government, Diplomatic, Commercial | Kaspersky (2026-05-22) — 'Cloud Atlas activity in the second half of 2025 and early 2026'; attributed with high confidence; victims observed late 2025 and early 2026 |
| Russia/Belarus phishing — CVE-2018-0802 → VBShower/VBCloud/PowerShower/CloudAtlas (H1 2025) | 2025-01 – 2025-06 | Russia, Belarus | Telecommunications, Construction, Government, Manufacturing | Kaspersky (2025-12-19) — 'Cloud Atlas activity in the first half of 2025' |
| Russia/Belarus government phishing — Equation Editor template → PowerShower (PT ESC IR) | 2024 – 2024-12 | Russia, Belarus | Government | Positive Technologies via Anti-Malware.ru (2024-12-12) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 8
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution1 | T1059.005Visual Basic |
| Stealth3 | T1027Obfuscated Files or InformationT1221Template InjectionT1218.010Regsvr32 |
| Discovery1 | T1518Software Discovery |
| Command and Control2 | T1102Web ServiceT1090.003Multi-hop Proxy |
Malware and tools 5
| Name | Description | Platform |
|---|---|---|
| PowerShower | PowerShell Backdoor | Windows |
| VBShower | VBScript Backdoor | Windows |
| VBCloud | VBScript backdoor (cloud C2) | Windows |
| CloudAtlas implant | C++ modular backdoor (WebDAV C2; FileGrabber, PasswordStealer, InfoCollector plugins) | Windows |
| PowerCloud | PowerShell collector (exfiltration to Google Sheets) | Windows |
Exploited vulnerabilities 4
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2012-0158 | 8.8 | Microsoft Windows Common Controls (MSCOMCTL.OCX) — RCE (KEV 2021-11-03) |
| CVE-2014-1761 | 7.8 | Microsoft Word — RTF memory corruption RCE (KEV 2022-02-15) |
| CVE-2017-11882 | 7.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
| CVE-2018-0802 | 7.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Cloud services reached over WebDAV act as C2 (Kaspersky, 2025)
Reporting and advisories 4
- Positive Technologies
Russia/Belarus government phishing — Equation Editor template → PowerShower (PT ESC IR) - Kaspersky
Russia/Belarus phishing — CVE-2018-0802 → VBShower/VBCloud/PowerShower/CloudAtlas (H1 2025) - Kaspersky
Russia/Belarus government and diplomatic targeting — LNK archives, SSH/RevSocks/Tor tunnels, PowerCloud (H2 2025 – early 2026) - MITRE ATT&CK
Cloud Atlas (G0100) group profile