A recent investigation has unveiled a cyber group, referred to as CloudSorcerer, engaging in espionage activities against Russian state entities. This group employs a complex digital surveillance tool, distinct from previously known malware, to extract sensitive information.
The discovery, made in May, points to a new threat actor that may have drawn inspiration from another group, CloudWizard, known for its cyber operations in areas of Ukraine under Russian control. Despite similarities in tactics, the two groups’ malware codes are not identical, suggesting independent development by CloudSorcerer of its espionage arsenal.
CloudSorcerer’s toolkit includes a custom malware that utilizes GitHub for initial command and control operations, and leverages mainstream cloud platforms like Yandex Cloud and Dropbox for discreet observation and data harvesting. This strategic use of trusted cloud services indicates a sophisticated and calculated approach to cyber spying.
The malware operates through various independent modules, such as those for communication and data gathering, which are manually activated on compromised systems. One such module acts as a backdoor, collecting detailed system information from the host machine.
Additionally, the malware can manage files and folders, altering data and system configurations, and even executing advanced commands, all while adapting its behavior to the environment it operates in. This adaptability and the intricate use of Windows communication protocols underscore the malware’s advanced nature.
The origins of CloudSorcerer’s infiltration techniques and their affiliations remain uncertain. However, the departure of many Western firms from Russia provides a unique insight into the cyber threats faced by local entities.
Parallel observations by U.S. researchers at Proofpoint have noted similar espionage efforts targeting American organizations, further expanding the scope of CloudSorcerer’s activities. These findings align with Kaspersky’s analysis, adding another layer to the understanding of this cyber espionage campaign.
Amidst these revelations, Kaspersky faces continued scrutiny and sanctions from the U.S. government, emphasizing the geopolitical complexities surrounding cybersecurity and international relations.
Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com
