The cyberespionage group known as Cloud Atlas is back, breaking into government bodies and private companies across Russia and Belarus, researchers at Kaspersky's Securelist report. The group, which Kaspersky has tracked since 2014, stayed active through the second half of 2025 and into 2026, and is now using a previously unseen tool the team calls PowerCloud, according to the original report. Notably, the attackers rely on SSH tunneling, a technique that quietly routes traffic through an encrypted connection, to hold onto access once inside.
What's affected
The targets are government organizations and commercial companies in Russia and Belarus, with the public sector and diplomatic circles most at risk. The attacks succeed even on systems that should be patched, because one delivery method still abuses a Microsoft Office bug from 2018 (CVE-2018-0802) in the Equation Editor component. Organizations that never applied that fix remain exposed.
How the attack works
It starts with phishing. The operators email ZIP archives that hide a malicious Windows shortcut file (an LNK). Opening the shortcut runs a PowerShell script hosted on a remote server, which drops a local loader (fixed.ps1) and opens a decoy PDF to keep the victim busy while it quietly cleans up. To survive reboots, it adds a startup registry entry disguised as "YandexBrowser_setup" so the malware blends in with a normal browser updater.
From there the loader installs two backdoors. VBCloud is a file stealer that runs in memory and hunts down documents (DOC, PDF, XLS) to send back to the attackers. PowerShower handles the snooping and spread, mapping out processes, administrator accounts and domain controllers, pulling down extra scripts, and running Kerberoasting, a method for cracking Active Directory passwords. To steal login credentials, the attackers make a Volume Shadow Copy (a behind-the-scenes backup of system files) and lift the SAM and SECURITY hives, hiding them as fake PDFs, while gaining higher privileges through a fodhelper.exe trick that sidesteps Windows User Account Control. To keep their grip, they patch termsrv.dll for multi-user remote desktop and add Tor, a modified version of OpenSSH and a tool called RevSocks as backup channels.
What you should do
Kaspersky published roughly sixty file hashes plus domains and IP addresses in its full report. A standout defanged indicator is the multi-RDP script rdp_new.ps1 (MD5 1a11b26dd0261ef27a112ce8b361c247), alongside the Equation Editor flaw CVE-2018-0802. Defenders, especially in government and diplomatic settings in Russia and Belarus, should watch for LNK files launching PowerShell, registry startup keys posing as browser updaters, unusual Volume Shadow Copy activity, and changes to termsrv.dll. Applying the long-available patch for CVE-2018-0802 closes one of the group's reliable entry points.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.