Cloudwizard

CloudWizard is a sophisticated malware discovered in May 2023, allegedly developed by an unidentified threat actor based in Ukraine. This malicious software has been linked to a broader set of cyber-attacks across the country, marking an evolution from its predecessors by exploiting well-known cloud services such as Google Drive, Microsoft OneDrive, and Dropbox for its command and control (C2) servers. The CloudWizard Advanced Persistent Threat (APT) campaign has played a significant role in the Russo-Ukrainian conflict area, indicating its potential use in cyber warfare. Upon analysis, it was found that CloudWizard shares multiple similarities with other malwares used in previous campaigns, namely CommonMagic and Prikormka, which were part of Operation Groundbait. These similarities include similar victim ID formats and file naming conventions for data uploaded to the C2 server. However, despite these resemblances, there are significant differences in code and functionality between CloudWizard and these earlier malwares, suggesting that CloudWizard might have been developed by a new actor possibly inspired by previous techniques but developing its own unique tools. Additionally, another malware framework known as CloudSorcerer, bearing resemblance to the CloudWizard APT, was reported. Despite the similarities in their modus operandi, the substantial differences in code and functionality suggest that CloudSorcerer is likely a separate entity, potentially influenced by previous techniques but creating its own distinctive tools. This ongoing development and evolution of malware underscores the need for continuous vigilance and updated cybersecurity measures.