Eastwind

EastWind is a threat actor identified by cybersecurity firm Kaspersky, known for executing actions with malicious intent. The group has recently launched a new campaign targeting Russian organizations, utilizing tools such as CloudSorcerer, APT31, and APT27. This campaign, dubbed "EastWind" by Kaspersky researchers, was discovered during an investigation into devices infected via phishing emails with malicious shortcut attachments. In this campaign, EastWind has been using a Trojan malware known as "GrewApacha," which has been associated with the China-nexus actor APT31 since at least 2021. GrewApacha allows EastWind to gather information about infected systems and install additional malicious payloads on them. While Kaspersky hasn't explicitly linked either APT31 or APT27 to the EastWind campaign, they have noted the use of both groups' malware in these attacks. The EastWind campaign's use of tools from different threat actors highlights a common trend among Advanced Persistent Threat (APT) groups: collaboration and sharing of malware tools and knowledge. Kaspersky interprets this as a sign of how interconnected and complex the landscape of cyber threats has become. Despite the unclear direct affiliations, the presence of these diverse tools within the EastWind campaign underscores its potential severity and sophistication.