Cloudsorcerer

CloudSorcerer, a threat actor group known for its malicious activities, has been identified by Kaspersky as the entity behind a new EastWind campaign targeting Russian organizations. The group updated their CloudSorcerer backdoor after it was initially described in a blog post by Kaspersky in early July 2024. This sophisticated cyber espionage tool was used to download additional payloads onto infected computers, including tools used by APT31 and APT27 groups, and an updated version of the CloudSorcerer backdoor itself. The new version of this backdoor now uses profile pages on the Russian-language social network LiveJournal and the Q&A site Quora as the initial command and control (C2) servers. The CloudSorcerer backdoor was also found to be involved in downloading the GrewApacha Trojan and a previously unknown implant onto infected computers. In addition, the adversary used the C2 servers to download 'CloudSorcerer,' a newly modified version of the same. Analysis of decrypted .ini files revealed them to be updated versions of the CloudSorcerer backdoor. Furthermore, the PlugY implant, which overlaps with code from APT27, is delivered using the CloudSorcerer backdoor, launching a process named msiexec.exe for each user signed into the OS and creating named pipes with the name template \.\PIPE\Y. CloudSorcerer's activities pose a significant threat to Russian organizations, including government entities. It has shown adaptability and sophistication by modifying its backdoor in response to public exposure and leveraging it to deliver various forms of malware. This demonstrates the group's persistent threat to cybersecurity and highlights the need for continuous vigilance and proactive defense strategies against such evolving cyber threats.