--- title: New APT Group 'CloudSorcerer' Targets Russian Government... description: The newly identified APT group 'CloudSorcerer' targets Russian government entities through advanced cyber espionage. Utilizing public cloud services like... canonical: https://daily.dev/posts/new-apt-group-cloudsorcerer-targets-russian-government-entities-using-cloud-services-9m2h5bowe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New APT Group 'CloudSorcerer' Targets Russian Government Entities Using Cloud Services | daily.dev og:description: The newly identified APT group 'CloudSorcerer' targets Russian government entities through advanced cyber espionage. Utilizing public cloud services like... og:url: https://daily.dev/posts/new-apt-group-cloudsorcerer-targets-russian-government-entities-using-cloud-services-9m2h5bowe og:image: https://api.daily.dev/og/posts/9M2h5BOwe.png og:image:alt: New APT Group 'CloudSorcerer' Targets Russian Government Entities Using Cloud Services og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New APT Group 'CloudSorcerer' Targets Russian Government Entities Using Cloud Services **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary The newly identified APT group 'CloudSorcerer' targets Russian government entities through advanced cyber espionage. Utilizing public cloud services like Microsoft Graph, Yandex Cloud, and Dropbox for C2 activities, the group employs sophisticated tactics such as dynamic behavior adaptation and complex inter-process communication to ensure stealth and persistence. The versatile malware used can execute multiple functions, including data exfiltration and covert monitoring, showcasing the evolving landscape of cyber threats and the necessity for advanced security measures. ## Content # CloudSorcerer APT Targets Russian Government Entities Using Advanced Cloud Services A newly identified advanced persistent threat (APT) group, dubbed 'CloudSorcerer,' has been targeting Russian government entities in a sophisticated cyber espionage campaign. This group leverages various cloud services—including Microsoft Graph, Yandex Cloud, and Dropbox—for command-and-control (C2) operations and data exfiltration. ## Sophisticated Tactics and Stealth Mechanisms CloudSorcerer employs advanced tactics to ensure stealth and persistence. The malware used by this group dynamically adapts its behavior based on the execution environment. It also exhibits complex inter-process communication through Windows pipes, enhancing its capability to remain undetected. ## Cloud Services for Command-and-Control A key aspect of CloudSorcerer's operations is its heavy reliance on public cloud services for C2 activities. The malware utilizes APIs and authentication tokens to interact with C2 servers hosted on Microsoft Graph API, Dropbox, and Yandex Cloud. Initial communication with C2 is often established via a GitHub page, where data is decoded using a hardcoded charcode table. ## Multifunctional Malware The primary tool deployed by CloudSorcerer is highly versatile. Once inside a target system, the malware collects machine information, executes shell commands, and can perform covert monitoring. It is equipped to handle multiple functions, including data collection and exfiltration via the mentioned cloud services. ## Unique Operational Techniques Although some of CloudSorcerer's tactics may resemble those of other known APT groups such as CloudWizard, CloudSorcerer operates with distinctive tools and techniques. The group's ability to adapt dynamically based on the running process, and its use of inter-process communication, sets it apart from other APT actors. ## Conclusion The emergence of CloudSorcerer highlights the evolving landscape of cyber threats, with APT groups increasingly utilizing public cloud services to enhance their stealth and operational effectiveness. As this threat actor continues to develop and refine its techniques, vigilant monitoring and advanced security measures are imperative for potential targets to mitigate the risks posed by such sophisticated cyber espionage campaigns. ## Similar posts on daily.dev - [Don’t just attend KubeCon \+ CloudNativeCon, Merge Forward your experience\!](https://daily.dev/posts/don-t-just-attend-kubecon-cloudnativecon-merge-forward-your-experience--l0rpp73x8) · CNCF · 1 upvotes · 0 comments - [Announcing H2 2026 KCDs](https://daily.dev/posts/announcing-h2-2026-kcds-m96goajm1) · CNCF · 1 upvotes · 0 comments - [Two months of Open Community Groups](https://daily.dev/posts/two-months-of-open-community-groups-asf52zhbs) · CNCF · 0 upvotes · 0 comments - [CNCF Unveils Schedule for KubeCon \+ CloudNativeCon Europe 2026](https://daily.dev/posts/cncf-unveils-schedule-for-kubecon-cloudnativecon-europe-2026-ikhcoa5cb) · CNCF · 2 upvotes · 0 comments - [CNCF Debuts KubeCon \+ CloudNativeCon Japan 2026 Schedule](https://daily.dev/posts/cncf-debuts-kubecon-cloudnativecon-japan-2026-schedule-xp5pyudub) · CNCF · 1 upvotes · 0 comments --- Tags: [#cloud](https://daily.dev/tags/cloud), [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-apt-group-cloudsorcerer-targets-russian-government-entities-using-cloud-services-9m2h5bowe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New APT Group 'CloudSorcerer' Targets Russian Government Entities Using Cloud Services","url":"https://daily.dev/posts/new-apt-group-cloudsorcerer-targets-russian-government-entities-using-cloud-services-9m2h5bowe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-apt-group-cloudsorcerer-targets-russian-government-entities-using-cloud-services-9m2h5bowe"},"datePublished":"2024-07-08T16:28:53.757Z","dateModified":"2024-07-08T21:39:37.979Z","description":"The newly identified APT group 'CloudSorcerer' targets Russian government entities through advanced cyber espionage. Utilizing public cloud services like...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef5f7c2319d21aad91e5e3f581065d01?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ef5f7c2319d21aad91e5e3f581065d01?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-apt-group-cloudsorcerer-targets-russian-government-entities-using-cloud-services-9m2h5bowe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cloud,cyber,malware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"New APT Group 'CloudSorcerer' Targets Russian Government Entities Using Cloud Services"}]} ```