--- title: EastWind campaign distributes CloudSorcerer and two APT... description: In late July 2024, targeted cyberattacks struck Russian government organizations and IT firms through phishing emails containing malicious shortcuts. The... canonical: https://daily.dev/posts/eastwind-campaign-distributes-cloudsorcerer-and-two-apt-tools-n0k6nlueg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: EastWind campaign distributes CloudSorcerer and two APT tools | daily.dev og:description: In late July 2024, targeted cyberattacks struck Russian government organizations and IT firms through phishing emails containing malicious shortcuts. The... og:url: https://daily.dev/posts/eastwind-campaign-distributes-cloudsorcerer-and-two-apt-tools-n0k6nlueg og:image: https://api.daily.dev/og/posts/N0K6NlUEG.png og:image:alt: EastWind campaign distributes CloudSorcerer and two APT tools og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # EastWind campaign distributes CloudSorcerer and two APT tools **[Securelist](https://daily.dev/sources/securelist)** · 9 min read · 1 upvotes · 0 comments ## Summary In late July 2024, targeted cyberattacks struck Russian government organizations and IT firms through phishing emails containing malicious shortcuts. The malware, using Dropbox for command and control, downloaded additional payloads including tools from APT31 and the updated CloudSorcerer backdoor. Notable discoveries include the GrewApacha RAT, improvements to CloudSorcerer utilizing LiveJournal and Quora profiles for C2 servers, and a newly observed implant dubbed PlugY, resembling tools from the APT27 group. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/eastwind-campaign-distributes-cloudsorcerer-and-two-apt-tools-n0k6nlueg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"EastWind campaign distributes CloudSorcerer and two APT tools","url":"https://daily.dev/posts/eastwind-campaign-distributes-cloudsorcerer-and-two-apt-tools-n0k6nlueg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/eastwind-campaign-distributes-cloudsorcerer-and-two-apt-tools-n0k6nlueg"},"datePublished":"2024-08-14T12:08:35.088Z","dateModified":"2024-11-08T07:38:37.235Z","description":"In late July 2024, targeted cyberattacks struck Russian government organizations and IT firms through phishing emails containing malicious shortcuts. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a85be76aaeb2d6a2d3580b5241186f2a?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a85be76aaeb2d6a2d3580b5241186f2a?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/eastwind-campaign-distributes-cloudsorcerer-and-two-apt-tools-n0k6nlueg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,phishing","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"EastWind campaign distributes CloudSorcerer and two APT tools"}]} ```