Cloudsorcerer

CloudSorcerer is a newly identified threat actor discovered by Kaspersky, which targets Russian government entities using cloud services for command and control (C2) infrastructure. Similar to the previously reported CloudWizard Advanced Persistent Threat (APT), CloudSorcerer leverages public cloud services such as Microsoft Graph, Yandex Cloud, and Dropbox for its C2 operations, demonstrating a sophisticated approach to cyber espionage. The actor also uses GitHub as its initial C2 server, indicating a well-planned strategy for initiating its malicious activities. The CloudSorcerer malware is an advanced cyber-espionage tool used for stealth monitoring, data collection, and exfiltration via the aforementioned cloud infrastructures. Attackers deploy a previously undetected malware named PlugY through the CloudSorcerer backdoor. Additionally, this threat actor has exhibited dynamic adaptability based on process context, further complicating cybersecurity efforts. A new variant of the CloudSorcerer backdoor, utilized in the EastWind campaign, employs a utility called GetKey.exe, packed with the VMProtect protector, to encrypt the malicious payload that can only be decrypted on the victim's computer. Since its initial discovery in July 2024, CloudSorcerer has been updated and now uses profiles on LiveJournal blog and Quora as its initial command servers. The malware receives commands via Dropbox, leading to the installation of additional Trojans, including tools from the APT31 cyber espionage group and an updated version of the CloudSorcerer backdoor named GrewApacha. This continued evolution and adoption of novel tactics underscores the persistent and escalating threat posed by CloudSorcerer.