CloudAtlas
- Malware type
- spyware, backdoor
- Family
- Malware family
- Last IoC activity
- 2026-06-04 15:24:37
- Profile updated
- 2026-07-07 12:53:45
Targeted industries: government-and-public-sector energy-and-utilities technology-and-telecommunications
Targeted regions: country_code:ru country_code:ua country_code:pl
Context
CloudAtlas is a sophisticated cyber espionage malware used for intelligence gathering, particularly targeting government and energy sectors in Eastern Europe. It is known for deploying various backdoors and spyware components to exfiltrate sensitive data.
Detection coverage
- 11 YARA rules
Detection rules
- SEKOIA_Apt_Cloudatlas_Powershower_Obfuscated (yara-rule)
- SEKOIA_Exploit_Win_Cloudatlas_Cve_2018_0798 (yara-rule)
- SEKOIA_Apt_Cloudatlas_Powershower_Module (yara-rule)
- SEKOIA_Apt_Cloudatlas_Powertunnel (yara-rule)
- SEKOIA_Apt_Cloudatlas_Powershower_Variant (yara-rule)
- SEKOIA_Apt_Cloudatlas_Init_Module_Virtualalloc (yara-rule)
- SEKOIA_Apt_Cloudatlas_Powershower_Clean (yara-rule)
- SEKOIA_Apt_Cloudatlas_Rtf_Shellcode_Cve_2018_0798 (yara-rule)
- SEKOIA_Apt_Cloudatlas_Stagescalldllmainafterexec (yara-rule)
- SIGNATURE_BASE_APT_MAL_Maldoc_Cloudatlas_Oct20_1 (yara-rule)
- SIGNATURE_BASE_APT_MAL_URL_Cloudatlas_Oct20_2 (yara-rule)
Reports & references
- web.archive.org — Blue Coat Exposes %E2%80%9C Inception Framework%E2%80%9D Very Sophisticated Layered Malware (report)
- malpedia.caad.fkie.fraunhofer.de — Apk.Cloudatlas (report)