Malwarehigh
Cloud Atlas using a new backdoor, VBCloud, to steal data
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | content-protect.net | y GReAT. Indicators of compromise HTA file download domains content-protect[.]net control-issue[.]net office-confirm[.]com onesoftware[.]in |
| domain | control-issue.net | compromise HTA file download domains content-protect[.]net control-issue[.]net office-confirm[.]com onesoftware[.]info serverop-parametr |
| domain | gosportal.net | ks[.]net yandisk[.]info mirconnect[.]info sber-cloud[.]info gosportal[.]net riamir[.]net web-wathapp[.]com PowerShower C2 yandisk[.]i |
| domain | kim.nl.tab.digital | t VBCloud does the following: Check the availability of the kim.nl.tab.digital WebDav server by sending an HTTP MKCOL request to create th |
| domain | mirconnect.info | ger-working[.]com VBShower C2 yandesks[.]net yandisk[.]info mirconnect[.]info sber-cloud[.]info gosportal[.]net riamir[.]net web-wathap |
| domain | net-plugin.org | esoftware[.]info serverop-parametrs[.]com web-privacy[.]net net-plugin[.]org triger-working[.]com VBShower C2 yandesks[.]net yandisk[. |
| domain | office-confirm.com | download domains content-protect[.]net control-issue[.]net office-confirm[.]com onesoftware[.]info serverop-parametrs[.]com web-privacy[. |
| domain | onesoftware.info | tent-protect[.]net control-issue[.]net office-confirm[.]com onesoftware[.]info serverop-parametrs[.]com web-privacy[.]net net-plugin[.]o |
| domain | riamir.net | [.]info mirconnect[.]info sber-cloud[.]info gosportal[.]net riamir[.]net web-wathapp[.]com PowerShower C2 yandisk[.]info yandeskto |
| domain | sber-cloud.info | VBShower C2 yandesks[.]net yandisk[.]info mirconnect[.]info sber-cloud[.]info gosportal[.]net riamir[.]net web-wathapp[.]com PowerShowe |
| domain | serverop-parametrs.com | control-issue[.]net office-confirm[.]com onesoftware[.]info serverop-parametrs[.]com web-privacy[.]net net-plugin[.]org triger-working[.]com V |
| domain | triger-working.com | serverop-parametrs[.]com web-privacy[.]net net-plugin[.]org triger-working[.]com VBShower C2 yandesks[.]net yandisk[.]info mirconnect[.]in |
| domain | web-privacy.net | e-confirm[.]com onesoftware[.]info serverop-parametrs[.]com web-privacy[.]net net-plugin[.]org triger-working[.]com VBShower C2 yandesk |
| domain | web-wathapp.com | nnect[.]info sber-cloud[.]info gosportal[.]net riamir[.]net web-wathapp[.]com PowerShower C2 yandisk[.]info yandesktop[.]com web-wathap |
| domain | yandesks.net | acy[.]net net-plugin[.]org triger-working[.]com VBShower C2 yandesks[.]net yandisk[.]info mirconnect[.]info sber-cloud[.]info gospor |
| domain | yandesktop.com | iamir[.]net web-wathapp[.]com PowerShower C2 yandisk[.]info yandesktop[.]com web-wathapp[.]com Cloud repositories used by VBCloud web |
| domain | yandisk.info | lugin[.]org triger-working[.]com VBShower C2 yandesks[.]net yandisk[.]info mirconnect[.]info sber-cloud[.]info gosportal[.]net riami |
| md5 | 0139f32a523d453bc338a67ca45c224d | C74C0BE9858853 F45008BF1889A8655D32A0EB93B8ACDD VBCloud MD5 0139F32A523D453BC338A67CA45C224D 01DB58A1D0EC85ADC13290A6290AD9D6 0F37E1298E4C82098DC9318C7E |
| md5 | 016b6a035b44c1ad10d070abcdfe2f66 | A00 VBShower::Launcher MD5 AA8DA99D5623FAFED356A14E59ACBB90 016B6A035B44C1AD10D070ABCDFE2F66 160A65E830EB97AAE6E1305019213558 184CF8660AF7538CD1CD2559A1 |
| md5 | 01db58a1d0ec85adc13290a6290ad9d6 | 32A0EB93B8ACDD VBCloud MD5 0139F32A523D453BC338A67CA45C224D 01DB58A1D0EC85ADC13290A6290AD9D6 0F37E1298E4C82098DC9318C7E65F9D2 6FCEE9878216019C8DFA887075 |
| md5 | 0f37e1298e4c82098dc9318c7e65f9d2 | 2A523D453BC338A67CA45C224D 01DB58A1D0EC85ADC13290A6290AD9D6 0F37E1298E4C82098DC9318C7E65F9D2 6FCEE9878216019C8DFA887075C5E68E D445D443ACE329FB244EDC3E51 |
| md5 | 15fd46ac775a30b1963281a037a771b1 | C384CA4666 A30319545FDA9E2DA0532746C09130EB PowerShower MD5 15FD46AC775A30B1963281A037A771B1 31B01387CA60A1771349653A3C6AD8CA 389BC3B9417D893F3324221141 |
| md5 | 160a65e830eb97aae6e1305019213558 | 9D5623FAFED356A14E59ACBB90 016B6A035B44C1AD10D070ABCDFE2F66 160A65E830EB97AAE6E1305019213558 184CF8660AF7538CD1CD2559A10B6622 1AF1F9434E4623B7046CF6360E |
| md5 | 184cf8660af7538cd1cd2559a10b6622 | 035B44C1AD10D070ABCDFE2F66 160A65E830EB97AAE6E1305019213558 184CF8660AF7538CD1CD2559A10B6622 1AF1F9434E4623B7046CF6360E0A520E 1BFB9CBA8AA23A401925D356B2 |
| md5 | 1af1f9434e4623b7046cf6360e0a520e | E830EB97AAE6E1305019213558 184CF8660AF7538CD1CD2559A10B6622 1AF1F9434E4623B7046CF6360E0A520E 1BFB9CBA8AA23A401925D356B2F6E7ED 21585D5881CC11ED1F615FDB2D |
| md5 | 1bfb9cba8aa23a401925d356b2f6e7ed | 660AF7538CD1CD2559A10B6622 1AF1F9434E4623B7046CF6360E0A520E 1BFB9CBA8AA23A401925D356B2F6E7ED 21585D5881CC11ED1F615FDB2D7ACC11 242E86E658FE6AB6E4C81B6816 |
| md5 | 21585d5881cc11ed1f615fdb2d7acc11 | 434E4623B7046CF6360E0A520E 1BFB9CBA8AA23A401925D356B2F6E7ED 21585D5881CC11ED1F615FDB2D7ACC11 242E86E658FE6AB6E4C81B68162B3001 2FE7E75BC599B1C68B87CF2A3E |
| md5 | 242e86e658fe6ab6e4c81b68162b3001 | BA8AA23A401925D356B2F6E7ED 21585D5881CC11ED1F615FDB2D7ACC11 242E86E658FE6AB6E4C81B68162B3001 2FE7E75BC599B1C68B87CF2A3E7AA51F 36DD0FBD19899F0B23ADE5A1DE |
| md5 | 2d24044c0a5b9ebe4e01ded2bfc2b3a4 | 11CB9D1D71F0FA70ECD1AF2480 CBFB691E95EE34A324F94ED1FF91BC23 2D24044C0A5B9EBE4E01DED2BFC2B3A4 88BE01F8C4A9F335D33FA7C384CA4666 A30319545FDA9E2DA0532746C0 |
| md5 | 2fe7e75bc599b1c68b87cf2a3e7aa51f | 5881CC11ED1F615FDB2D7ACC11 242E86E658FE6AB6E4C81B68162B3001 2FE7E75BC599B1C68B87CF2A3E7AA51F 36DD0FBD19899F0B23ADE5A1DE3C2FEC 389F6E6FD9DCC84C6E944DC387 |
| md5 | 31b01387ca60a1771349653a3c6ad8ca | 46C09130EB PowerShower MD5 15FD46AC775A30B1963281A037A771B1 31B01387CA60A1771349653A3C6AD8CA 389BC3B9417D893F3324221141EDEA00 VBShower::Launcher MD5 AA8 |
| md5 | 36dd0fbd19899f0b23ade5a1de3c2fec | E658FE6AB6E4C81B68162B3001 2FE7E75BC599B1C68B87CF2A3E7AA51F 36DD0FBD19899F0B23ADE5A1DE3C2FEC 389F6E6FD9DCC84C6E944DC387087A56 3A54ACD967DD104522BA7D66F4 |
| md5 | 389bc3b9417d893f3324221141edea00 | AC775A30B1963281A037A771B1 31B01387CA60A1771349653A3C6AD8CA 389BC3B9417D893F3324221141EDEA00 VBShower::Launcher MD5 AA8DA99D5623FAFED356A14E59ACBB90 016 |
| md5 | 389f6e6fd9dcc84c6e944dc387087a56 | 5BC599B1C68B87CF2A3E7AA51F 36DD0FBD19899F0B23ADE5A1DE3C2FEC 389F6E6FD9DCC84C6E944DC387087A56 3A54ACD967DD104522BA7D66F4D86544 3F12BF4A8D82654861B5B5993C |
| md5 | 3a54acd967dd104522ba7d66f4d86544 | BD19899F0B23ADE5A1DE3C2FEC 389F6E6FD9DCC84C6E944DC387087A56 3A54ACD967DD104522BA7D66F4D86544 3F12BF4A8D82654861B5B5993C012BFA 49F8ED13A8A13799A34CC999B1 |
| md5 | 3f12bf4a8d82654861b5b5993c012bfa | 6FD9DCC84C6E944DC387087A56 3A54ACD967DD104522BA7D66F4D86544 3F12BF4A8D82654861B5B5993C012BFA 49F8ED13A8A13799A34CC999B195BF16 4B96DC735B622A94D3C74C0BE9 |
| md5 | 49f8ed13a8a13799a34cc999b195bf16 | D967DD104522BA7D66F4D86544 3F12BF4A8D82654861B5B5993C012BFA 49F8ED13A8A13799A34CC999B195BF16 4B96DC735B622A94D3C74C0BE9858853 F45008BF1889A8655D32A0EB93 |
| md5 | 4b96dc735b622a94d3c74c0be9858853 | 4A8D82654861B5B5993C012BFA 49F8ED13A8A13799A34CC999B195BF16 4B96DC735B622A94D3C74C0BE9858853 F45008BF1889A8655D32A0EB93B8ACDD VBCloud MD5 0139F32A523D45 |
| md5 | 6fcee9878216019c8dfa887075c5e68e | A1D0EC85ADC13290A6290AD9D6 0F37E1298E4C82098DC9318C7E65F9D2 6FCEE9878216019C8DFA887075C5E68E D445D443ACE329FB244EDC3E5146313B F3F28018FB5108B516D802A038 |
| md5 | 88be01f8c4a9f335d33fa7c384ca4666 | 1E95EE34A324F94ED1FF91BC23 2D24044C0A5B9EBE4E01DED2BFC2B3A4 88BE01F8C4A9F335D33FA7C384CA4666 A30319545FDA9E2DA0532746C09130EB PowerShower MD5 15FD46AC77 |
| md5 | 9d3557cc5c444fe5d73e4c7fe1872414 | bdav.mydrive.ch webdav.yandex.ru kim.nl.tab.digital HTA MD5 9D3557CC5C444FE5D73E4C7FE1872414 CBA05E11CB9D1D71F0FA70ECD1AF2480 CBFB691E95EE34A324F94ED1FF |
| md5 | a30319545fda9e2da0532746c09130eb | 4C0A5B9EBE4E01DED2BFC2B3A4 88BE01F8C4A9F335D33FA7C384CA4666 A30319545FDA9E2DA0532746C09130EB PowerShower MD5 15FD46AC775A30B1963281A037A771B1 31B01387CA |
| md5 | aa8da99d5623fafed356a14e59acbb90 | 8CA 389BC3B9417D893F3324221141EDEA00 VBShower::Launcher MD5 AA8DA99D5623FAFED356A14E59ACBB90 016B6A035B44C1AD10D070ABCDFE2F66 160A65E830EB97AAE6E1305019 |
| md5 | cba05e11cb9d1d71f0fa70ecd1af2480 | kim.nl.tab.digital HTA MD5 9D3557CC5C444FE5D73E4C7FE1872414 CBA05E11CB9D1D71F0FA70ECD1AF2480 CBFB691E95EE34A324F94ED1FF91BC23 2D24044C0A5B9EBE4E01DED2BF |
| md5 | cbfb691e95ee34a324f94ed1ff91bc23 | CC5C444FE5D73E4C7FE1872414 CBA05E11CB9D1D71F0FA70ECD1AF2480 CBFB691E95EE34A324F94ED1FF91BC23 2D24044C0A5B9EBE4E01DED2BFC2B3A4 88BE01F8C4A9F335D33FA7C384 |
| md5 | d445d443ace329fb244edc3e5146313b | 298E4C82098DC9318C7E65F9D2 6FCEE9878216019C8DFA887075C5E68E D445D443ACE329FB244EDC3E5146313B F3F28018FB5108B516D802A038F90BDE |
| md5 | f3f28018fb5108b516d802a038f90bde | 878216019C8DFA887075C5E68E D445D443ACE329FB244EDC3E5146313B F3F28018FB5108B516D802A038F90BDE |
| md5 | f45008bf1889a8655d32a0eb93b8acdd | 13A8A13799A34CC999B195BF16 4B96DC735B622A94D3C74C0BE9858853 F45008BF1889A8655D32A0EB93B8ACDD VBCloud MD5 0139F32A523D453BC338A67CA45C224D 01DB58A1D0EC85 |
From the original article
12 min read at securelist.com
Known since 2014, Cloud Atlas targets Eastern Europe and Central Asia. We’re shedding light on a previously undocumented toolset, which the group used heavily in 2024. Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formula editor ( CVE-2018-0802 ) to download and execute malware code.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.