CloudSorcerer
Summary
Discovered May 2024 by Kaspersky targeting Russian government entities. Uses public cloud services (Microsoft Graph, Yandex Cloud, Dropbox) as command-and-control infrastructure, accessing them via APIs with authentication tokens retrieved from GitHub or my.mail.ru photo albums. Dynamically adapts behaviour based on the process it infects (different behaviour in mspaint.exe vs msiexec.exe). Kaspersky notes that Proofpoint reported a CloudSorcerer attack on a US organisation in July 2024. Tradecraft reminiscent of CloudWizard (2023, targeting Russian-occupied Ukraine) but with completely different codebase. Later reused by likely-China-linked EastWind campaign (APT27/APT31 tool sharing, August 2024), showing cross-actor malware adoption.
Attribution
Tool overlap with APT31; first tracked as a new actor
Hedged, circumstantial or press-only reporting; not established.
- Positive Technologies (PT ESC) (Research, 2025-11)
APT31 uses the CloudSorcerer backdoor (tool overlap) - Kaspersky GReAT (Research, 2024-07-08)
First tracked CloudSorcerer as a new, unattributed actor
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| EastWindASSESSED | 2024-07 | Russia | Government, IT | Kaspersky GReAT (2024-08-14) — updated CloudSorcerer (LiveJournal/Quora initial C2) delivered alongside APT31's GrewApacha; PlugY loaded via CloudSorcerer — Kaspersky ties the campaign to APT27 and APT31 tooling; the updated CloudSorcerer backdoor is a tool sighting |
| Russian Government Targeting | 2024-05 – 2024-07 | Russia | Government | Kaspersky GReAT (2024-07-08) — discovered May 2024; EastWind follow-up shows activity continuing to late July 2024 |
| Russian IT contractors and integrators — APT31 toolset incl. CloudSorcererASSESSED | 2024 – 2025 | Russia | IT, Government | Positive Technologies PT ESC (Nov 2025) — attributes the 2024–2025 attacks to APT31 (Zirconium), which "still uses CloudSorcerer"; tool overlap, not a CloudSorcerer operation |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Stealth2 | T1055Process InjectionT1027Obfuscated Files or Information |
| Exfiltration1 | T1567.002Exfiltration to Cloud Storage |
| Command and Control1 | T1102.002Bidirectional Communication |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| CloudSorcerer | Cloud-based Backdoor | Windows |
| PlugY | Implant (APT27 overlap) | Windows |
Infrastructure patterns
- Microsoft Graph, Yandex Cloud and Dropbox as C2; GitHub for initial C2 contact (Kaspersky, 2024)
Reporting and advisories 3
- Kaspersky
CloudSorcerer APT Analysis - Kaspersky GReAT
EastWind - Positive Technologies PT ESC
Russian IT contractors and integrators — APT31 toolset incl. CloudSorcerer