Cloud Atlas

THREAT ACTOR PROFILE

Cloud Atlas

Cloud Atlas is an espionage group active since 2014, also known as Inception, that targets government and diplomatic organizations in Russia, Belarus and across Eastern Europe and Central Asia. It is known for a reliable phishing chain built on Microsoft Office Equation Editor exploitation and a long-lived toolset of VBShower, PowerShower and cloud-based backdoors.

Not firmly attributed

Government / Diplomatic

First seen

2014

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Cloud Atlas and Inception

Cloud Atlas is tracked under a few names for the same activity. In our records it maps to one entry among the Russia-linked actors we track, and its targeting overlaps in region with Russian actors like Callisto.

GROUP PROFILE

A reliable phishing chain, rarely changed

Cloud Atlas collects intelligence against government, diplomatic and defense-industry targets, with recent campaigns concentrated on Russia and Belarus. Attribution is debated, which is why our record does not assert a firm origin country.

Our record ties it to espionage across Eastern Europe and Central Asia. The group is notable for consistency: it has leaned on the same Equation Editor exploit and VBShower-led toolkit for years.

Its chain is dependable rather than flashy: phishing documents or LNK shortcuts exploit CVE-2018-0802 to install VBShower, which orchestrates PowerShower, VBCloud and the CloudAtlas backdoor, using cloud services and scheduled tasks for persistence.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

Equation Editor exploits into a VBShower chain

The stages below come from Cloud Atlas activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

VBShower, PowerShower and the Cloud backdoors

Initial Access

CVES EXPLOITED

Equation Editor, year after year

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

Cloud Atlas

IOCS FROM HUNT.IO PLATFORM

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete

Cloud Atlas

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete

Cloud Atlas

IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

CloudAtlasGo and a multi-session RDP trick

Recent reporting tracks the group's new tools and its consistent chain.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.