PowerCloud
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cloud Atlas APT Targets Russia and Belarus Government and Diplomatic Entities with PowerCloud Tool
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
When a victim opens the shortcut, it quietly runs a PowerShell script pulled from an external server. That script sets up persistence, downloads a decoy PDF to distract the user, removes infection traces, and deploys payloads including a backdoor called VBCloud and a reconnaissance tool called PowerShower.
Stealth
1 technique
Stealth
Discovery
4 techniques
Discovery
PowerShower can perform the following tasks: Collect information about running processes, administrator groups, and domain controllers.
PowerShower can perform the following tasks: Collect information about running processes, administrator groups, and domain controllers.
Command and Control
3 techniques
Command and Control
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom Cloud Atlas malware family referenced in the IoCs, used for persistence and covert access on compromised Windows hosts.
Obfuscated PowerShell reconnaissance tool, often packaged with PS2EXE, that enumerates administrator users on a victim host, adds the computer name and current date, Base64-encodes the data, and writes it into an existing Google Sheets document.
Referenced as a named tool used by Cloud Atlas APT against government and diplomatic entities in Russia and Belarus.
An obfuscated PowerShell-based Cloud Atlas data collection tool, often packaged with PS2EXE, that gathers host/user administrative information and exfiltrates it by appending Base64-encoded data to Google Sheets.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.