CLOUDBURST
Aliases: NickelLoader
- First seen
- 2022-04-01 00:00:00
- Malware type
- downloader, loader, trojan
- Family
- Malware family
- Profile updated
- 2026-07-07 13:14:19
Targeted industries: defense-and-aerospace technology-and-telecommunications
Context
CLOUDBURST aka NickelLoader is an HTTP(S) downloader. It recognizes a set of four basic commands, all five letters long, like abcde, avdrq, gabnc and dcrqv (alternatively: eknag, eacec, hjmwk, wohnp). The most important functionality is to load a received buffer, either as a DLL via the MemoryModule implementation, or as a shellcode. It uses AES for encryption and decryption of network traffic. It usually sends the following information back to its C&C server: computer name, product name and the list of running processes. Typically, it uses two hardcoded parameter names for its initial HTTP POST requests: gametype and type (alternatively: type and code). The CLOUDBURST payload is disguised as mscoree.dll and is side-loaded via a legitimate Windows binary PresentationHost.exe with the argument -embeddingObject. It comes either as a trojanized plugin project for Notepad++ (usually FingerText by erinata), or as a standalone DLL loaded by a dropper, which is a trojanized plugin project as well (usually NppyPlugin by Jari Pennanen). The CLOUDBURST malware was used in Operation DreamJob attacks against an aerospace company and a network running Microsoft Intune software in Q2-Q3 2022.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Cloudburst_Auto (yara-rule)
Reports & references
- Mandiant — Lightshow North Korea Unc2970 (report)
- virusbulletin.com — Lazarus Campaigns And Backdoors In 2022 2023 (report)
- Microsoft — Zinc Weaponizing Open Source Software (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Cloudburst (report)
- ESET — Lazarus Luring Employees Trojanized Coding Challenges Case Spanish Aerospace Company (report)