Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload

Reported 22 May 2026 by otx · Severity: medium

Cloud Atlas APT group targeted government organizations and commercial companies in Russia and Belarus during late 2025 and early 2026, employing phishing campaigns with malicious ZIP archives containing LNK shortcuts. The attackers deployed multiple backdoors including VBCloud f