Cloudwizard

CloudWizard is a malicious software (malware) that has been used in advanced persistent threat (APT) campaigns. First reported by Kaspersky in 2023, it has been linked to cyber warfare activities in the Russo-Ukrainian conflict area. The malware operates by infiltrating systems and performing harmful actions such as taking screenshots, recording via the microphone, keylogging, and more. It also heavily leverages public cloud services for command and control (C2) operations. Despite similarities with the Prikormka malware used in Operation Groundbait, CloudWizard appears to be a distinct entity. In recent developments, Kaspersky discovered a new APT named "CloudSorcerer" targeting Russian government entities using similar tactics to CloudWizard, namely the use of cloud services for C2 operations. However, despite these operational similarities, there are significant differences between the two in terms of code and functionality. This suggests that while CloudSorcerer may have been inspired by CloudWizard's techniques, it is likely a new actor in the field of cyber espionage. The discovery of CloudSorcerer highlights the evolving landscape of cyber warfare actors. Despite some operational overlap, CloudSorcerer's unique code and functionality indicate that it is not a mere iteration of CloudWizard but a new player employing similar tactics. This underscores the importance of continued vigilance and adaptation in cybersecurity strategies, given the rapid evolution and diversification of threat actors.