Cloud Atlas Strikes Russia and Belarus with Stealthy Phishing Campaign Exploiting Old Office Flaw

Cybersecurity researchers have identified a fresh wave of highly targeted phishing attacks attributed to the threat actor group known as Cloud Atlas. In this campaign, malicious actors are leveraging a nearly six‑year‑old Microsoft Office vulnerability to deliver a cascade of stealthy backdoors and establish resilient command‑and‑control channels while avoiding detection. The operation appears tailored at government, military, diplomatic and strategic organizations in Russia and Belarus, suggesting espionage motives rather than indiscriminate criminal theft.

In this long‑running campaign, Cloud Atlas exploits CVE‑2018‑0802, a memory corruption flaw in Microsoft Office that has been publicly known and patched since 2018. The attackers embed malicious content in Office documents delivered via phishing emails. Once a victim opens the booby‑trapped file, an HTA (HTML Application) is executed, triggering a sequence of scripts that install multiple malware families: VBShower, VBCloud and PowerShower. These backdoors provide broad remote access, persistence and data exfiltration capabilities. To evade traditional detection mechanisms, the malware leverages DLL hijacking, a technique where a legitimate process is tricked into loading a malicious DLL instead of the real one.

Cloud Atlas further hides its command‑and‑control (C2) infrastructure and communications by using mainstream cloud services as relay platforms — a tactic that blends malicious traffic with normal cloud traffic and complicates defensive analysis. Once established, the implanted backdoors communicate with these cloud‑hosted endpoints to receive commands, push stolen data and further infect networks. Analysts observing this activity note that the use of archived — but still unpatched in some cases — systems in targeted organizations, coupled with the actor’s careful operational security, allowed the threat to persist for extended periods without easy detection. In addition to technical sophistication, the geographic focus on Russia and Belarus — regions traditionally less targeted by Western espionage malware — has raised questions about shifting priorities in the cyber threat landscape.

What Undercode Say:

Cloud Atlas’s latest phishing campaign underscores a persistent truth in cyber defense: old vulnerabilities never die if they aren’t patched. CVE‑2018‑0802 was disclosed and fixed years ago, yet this incident confirms that many organizations still operate legacy systems with unmitigated risk. That Cloud Atlas returns to a known flaw highlights attackers’ cost‑benefit calculus — why invest in zero‑days when widely available patches can yield easy initial access? Security teams must internalize that patching isn’t a one‑time event but a continuous discipline.

Also notable is the choice of phishing as the initial attack vector. Despite advances in email filtering and user awareness training, social engineering remains a primary attack method because it targets the human element — often the least hardened aspect of a network. Here, phishing was paired with file formats that still enjoy legitimate business use, like Office documents, enabling the threat actor to slip malicious content into routine workflows.

The deployment of HTA and DLL hijacking demonstrates layered stealth. HTAs run with scripting capabilities that can bypass macro restrictions, and DLL hijacking abuses trust in legitimate binaries. These aren’t cutting‑edge techniques, but they are effective when defenders overlook them. Instead of chasing the latest malware innovation, defenders need to harden existing controls — disable obsolete features, enforce application whitelisting, and regularly audit file types allowed in mail gateways.

Cloud Atlas also shows maturity in its use of cloud services for C2. By hiding command traffic within cloud provider infrastructure, they exploit the implicit trust many organizations have in those platforms. Traditional network monitoring tools often white‑list cloud service provider traffic, giving attackers hidden channels to move data. Detecting such abuse requires behavioral analytics and anomaly detection that go beyond simple allow/block lists.

The geographic focus on Russia and Belarus is particularly intriguing. Historically, many APT (Advanced Persistent Threat) campaigns have tracked against Western targets. Targeting these regions suggests either intelligence priorities have shifted or that Cloud Atlas has operational motives linked to broader geopolitical objectives. This could imply increased cyber espionage activity centered on eastern European strategic interests, and possibly reciprocal operations in contested intelligence arenas.

Organizations should treat this campaign as a wake‑up call. Investing in threat hunting, patch management maturity, and phishing simulation programs can raise the cost for attackers. Defensive strategies should include segmentation, least‑privilege enforcement, and multi‑factor authentication to limit the damage even if initial access is gained. Realistically, well‑funded adversaries like Cloud Atlas won’t stop innovating; defenders must embrace proactive security measures rather than reactive firefighting.

Fact Checker Results:

CVE‑2018‑0802 is a known Microsoft Office vulnerability first disclosed and patched in 2018. ✅

Cloud Atlas uses HTA files and multiple backdoors (VBShower, VBCloud, PowerShower) to maintain persistence and control. ✅

The campaign specifically targets Russian and Belarusian entities for espionage‑style objectives. ❓ (Attribution to actor motive is based on analysis, not public official confirmation.)

Prediction:

Over the next year, similar campaigns exploiting legacy vulnerabilities will rise as long as patch backlogs persist in large enterprises and public institutions. Adversaries like Cloud Atlas will increasingly leverage trusted cloud platforms for C2, forcing defenders to adopt zero‑trust network monitoring and invest in AI‑driven anomaly detection to identify malicious use of legitimate services. Phishing will remain a primary vector, evolving with more convincing social engineering tailored to regional targets, especially as geopolitical tensions continue to reshape cyber threat priorities.