Rewterz Threat Alert – Cloud Atlas APT Threat Actors aka Inception – Active IOCs

Severity

High

Analysis Summary

Cloud Atlas is a sophisticated Advanced Persistent Threat (APT) group that has been active since at least 2014. Also known as “Inception”, “RedOctober”, and “Snowball”, Cloud Atlas is known for using custom malware and advanced tactics to target government entities, military organizations, and financial institutions primarily in Eastern Europe and Central Asia.

Cloud Atlas primarily uses spear-phishing emails with malicious attachments or links to compromise target systems. Once inside a system, they use a variety of techniques to maintain persistence and evade detection, including using anti-forensic tools and hiding their activities in legitimate system processes. For many years, this threat actor group mostly employ open email services like Yandex, Mail.ru, and Outlook.com, although they have occasionally tried to spoof the domains of other companies that the victim is likely to trust.

Cloud Atlas has been linked to a number of high-profile attacks, including the theft of millions of dollars from banks in Russia, Kazakhstan, and Ukraine. The group has also targeted diplomatic organizations and military institutions in Eastern Europe and Central Asia, as well as organizations in the Middle East and Africa.

To defend against the Cloud Atlas APT group, organizations should implement robust security measures such as two-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Organizations should also maintain up-to-date patches and antivirus software to prevent the exploitation of known vulnerabilities. 

Impact

• Data Theft
• Disruption Of Operations
• Reputational Damage

Indicators of Compromise

MD5

• e1f118af01a87bfc473c6a60d5ab50f5
• 911174d26e5a715f5771a50d00a1582d
• 169960d97529d0faff7d5f6a0af26faf

SHA-256

• be933c8edd3601a570994b003f60554329b18df5e844aa140f056b7e9b5d01d6
• 2e2a0f3e626a638812b8fbf96aae3e119283c1f3c9a96130ef90fe3879034c25
• 586afacabe239b2a0043fd1c673e65b3289a77c0db602963781578d96bfd7391

SHA-1

• e766fbd00877d7df74967a40ee568695a8e0fe61
• 18aac07ee02d71be838f9b466919d637196363a2
• da8b2ced44059dfe52a33f112d6b2892cedb1735

URL

https://protocol-list.com/OFFICE2003/galliasses/unprofit

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Maintain up-to-date patches and antivirus software to prevent the exploitation of known vulnerabilities. 
• Organizations should conduct regular vulnerability assessments and penetration testing to identify and mitigate potential security weaknesses.
• Implement robust security measures such as two-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training.