PowerCloud
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cloud Atlas APT Targets Russia and Belarus Government and Diplomatic Entities with PowerCloud Tool
Techniques & procedures
10 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 techniqueWhen a victim opens the shortcut, it quietly runs a PowerShell script pulled from an external server. That script sets up persistence, downloads a decoy PDF to distract the user, removes infection traces, and deploys payloads including a backdoor called VBCloud and a reconnaissance tool called PowerShower.
Stealth
1 techniqueCopies the SAM ... and SECURITY system files from this shadow copy to C:\Users\Public\Documents\, disguising them as PDF files.
Discovery
4 techniquesPowerShower can perform the following tasks: Collect information about running processes, administrator groups, and domain controllers.
PowerShower can perform the following tasks: Collect information about running processes, administrator groups, and domain controllers.
PowerShower может выполнять следующие задачи: сбор информации о запущенных процессах, группах администраторов и контроллерах домена.
PowerCloud ... собирает сведения о пользователях с правами администратора ... Для поиска администраторов на хосте жертвы инструмент выполняет следующую команду
Command and Control
3 techniquesThis is the main module that connects to a C2 server to receive additional scripts or execute built-in commands.
When a victim opens the shortcut, it quietly runs a PowerShell script pulled from an external server.
Сведения кодируются по алгоритму Base64, после чего вносятся в существующий документ Google Таблиц.
Exfiltration
1 techniquePowerCloud ... записывает их в Google Таблицы в формате Base64.
IOCs tracked for this family
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom Cloud Atlas malware family referenced in the IoCs, used for persistence and covert access on compromised Windows hosts.
Obfuscated PowerShell reconnaissance tool, often packaged with PS2EXE, that enumerates administrator users on a victim host, adds the computer name and current date, Base64-encodes the data, and writes it into an existing Google Sheets document.
Referenced as a named tool used by Cloud Atlas APT against government and diplomatic entities in Russia and Belarus.
An obfuscated PowerShell-based Cloud Atlas data collection tool, often packaged with PS2EXE, that gathers host/user administrative information and exfiltrates it by appending Base64-encoded data to Google Sheets.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.