Cloud Atlas Cloud Atlas

  • First known sample

    2014

  • Discovery

    2014

  • Number of targets

    1-100

  • Current status

    Active

  • Type

    Trojan

  • Targeted platforms

    Android , Linux , Windows , iOS

  • TOP targeted countries

    Belarus , India , Kazakhstan , Russia , The Czech Republic

  • Connected attacks

    Red October
CLOUD ATLAS

More about the Cloud Atlas group, its tactics, techniques, procedures and tools

Learn more

  • The way of propagation

    Exploits , Social engineering

  • Purpose/Functions

    Cyberespionage , Data theft , Data wiping
  • Special features

    CloudAtlas represents a rebirth of the RedOctober attacks.

  • Targets

    Diplomatic organizations/embassies , Government entities
  • Artefacts/Attribution

    The same threat actor as behind the Red October attacks

  • Description

    A threat actor that was first noticed in 2014 and launches cyber-espionage operations against industries and government entities. The actor delivers its backdoors through spear-phishing emails aimed at high profile victims.

    Additional information

© 2025 AO Kaspersky Lab. All Rights Reserved. Privacy Policy Cookies
  1. Adding detection for known modules
  2. Collecting samples
  3. Reversing the samples
  4. Decrypting sophisticated encryption and compression schemes
  5. Understanding lateral movement
  6. Outlining multiple attack stages in the correct order
  7. Mapping C&C infrastructure
  8. Setting up sinkholes
  9. Analyzing collected traffic and communication protocols
  10. Crawling other hosts that understand the same protocol
  11. Taking down and acquiring images of C&C servers
  12. Identifying victims, sending out notifications to victims and global CERTs
  13. Applying forensic analysis and extracting logs, stolen files, other components
  14. Collecting and analyzing data from KSN, C&C servers, individual victims who are willing to work with us, sinkholes, crawlers, etc.
  15. Writing a comprehensive report
Read more
Mitigation is where enterprises need to start, prevention being significantly more effective and more cost-efficient than remediation after an attack Read more
For any inquiries, please contact apt.securelist@kaspersky.com If you are looking for more detailed information about an APT, please contact intelreports@kaspersky.com