Cloudwizard

CloudWizard is a potent malware that has been implicated in advanced persistent threat (APT) campaigns, specifically those related to the Russo-Ukrainian conflict. It was first reported by Kaspersky in 2023 and is known for its features like taking screenshots, microphone recording, keylogging, among others. This malware is particularly notable for its use of cloud services for command and control (C2), a tactic that allows it to effectively hide and operate. Furthermore, CloudWizard shares multiple similarities with the malware used in the Operation Groundbait campaign, particularly with the Prikormka malware, and CommonMagic. However, recent developments have uncovered a new APT actor dubbed "CloudSorcerer" by Kaspersky, which has been targeting Russian government entities. Like CloudWizard, CloudSorcerer heavily leverages public cloud services for C2 and other purposes. Despite these operational similarities, significant differences in code and functionality suggest that CloudSorcerer is likely a new actor, possibly inspired by previous techniques but developing its own unique tools. In conclusion, while there are evident parallels between CloudWizard and CloudSorcerer in terms of tactics and targets, Kaspersky's analysis indicates that they are distinct actors in the cyber-espionage landscape. Both groups demonstrate the growing trend of APT actors utilizing cloud services for their operations, highlighting the need for enhanced security measures in the cloud computing sphere.