New wave of cyberattacks by APT group Cloud Atlas on Russia's government sector

The APT group Cloud Atlas has launched a new wave of cyberattacks targeting Russia's defense industry. They are using stolen document templates from previously infected organizations to create malicious Microsoft Office files. The group cleans metadata from these documents to avoid revealing compromised entities. They move between targeted companies using compromised email accounts (BEC attacks). The attacks focus on defense industry enterprises, with malicious documents disguised as invitations, anti-corruption checks, mobilization documents, employee records, and financial statements. Cloud Atlas uses Google Sheets API for data exfiltration and employs the PowerShower backdoor. The group's infrastructure has migrated to new servers and domains, indicating ongoing campaign development.

• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseCampaign2026-10-21
• AI-Powered Espionage Campaign Targets Government Linux InfrastructureCampaign2026-10-15
• Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threatsCampaign2026-10-13
• I taught my laptop to fake cyberattacks — and it's scarily good at it.Tool2026-09-30