Cloud Atlas hackers target Russian agriculture sector ahead of industry forum
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) |
Full article421 words · extracted from therecord.media · click to collapse
A Russia-based cybersecurity firm has uncovered another cyber-espionage campaign by the state-backed threat actor Cloud Atlas, which targeted the country’s agricultural sector using lures tied to an upcoming industry forum. The attack, which is the second time the group has hit Russia’s agro industrial firms in recent months, coincided with preparations for the Russian agriculture forum scheduled for the end of the month in Moscow. According to researchers at F6, the hackers sent phishing emails disguised as the event’s official program, containing a malicious file that exploited an old Microsoft Office flaw — CVE-2017-11882, a vulnerability patched in 2017 but still widely abused by cybercriminals. The same flaw was exploited back in 2023, when Cloud Atlas targeted a Russian agro-industrial enterprise and a state-owned research company with phishing emails related to Russia’s war in Ukraine. The exploit allows attackers to execute malicious code and potentially take full control of the system, giving them the ability to install software, alter or delete data and create new user accounts. Researchers noted that Cloud Atlas — also tracked as Inception — has shown increased activity throughout 2025, particularly against Russian and Belarusian targets. F6 also found indications that a defense enterprise was among the group’s October targets, though they did not provide technical details. According to the report, Cloud Atlas continues to refine its tools and delivery methods, experimenting with different payloads while maintaining long-used infection chains. “Cloud Atlas’s continued use of the same tactics and exploitation of long-known vulnerabilities suggests its attacks remain effective — largely due to unprotected or poorly maintained systems and the human factor,” researchers said. Cloud Atlas — active since at least 2014 — is a state-sponsored espionage group known for attacks on organizations in Russia, Belarus, Azerbaijan, Turkey and Slovenia. Its operations focus on data theft and surveillance, though the exact country behind it remains unclear. The hackers typically rely on multi-stage phishing campaigns, sending emails that mimic government correspondence, business offers or media materials. Their malware often employs custom-built loaders and encrypted communications to remain undetected and exfiltrate stolen data. “These factors make Cloud Atlas a highly capable and persistent threat to organizational cybersecurity,” researchers added.
No previous article
No new articles
Daryna Antoniuk
is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cloud-atlas-targets-russian-agriculture