Kaspersky has identified a new EastWind campaign targeting Russian organizations and using CloudSorcerer as well as APT31 and APT27 tools.

Securelist is a cybersecurity blog and research platform operated by Kaspersky Lab. It offers insights, analysis, and reports on cybersecurity threats, vulnerabilities, and malware campaigns. Developers can learn about emerging cyber threats, security best practices, and mitigation strategies to protect their applications and systems. Additionally, Securelist provides insights into cybersecurity trends, threat intelligence, and industry developments, offering resources for cybersecurity professionals.

Securelist

In late July 2024, targeted cyberattacks struck Russian government organizations and IT firms through phishing emails containing malicious shortcuts. The malware, using Dropbox for command and control, downloaded additional payloads including tools from APT31 and the updated CloudSorcerer backdoor. Notable discoveries include the GrewApacha RAT, improvements to CloudSorcerer utilizing LiveJournal and Quora profiles for C2 servers, and a newly observed implant dubbed PlugY, resembling tools from the APT27 group.

EastWind campaign distributes CloudSorcerer and two APT tools