Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
2026-05-25T08:51:55Z•68817e93169d922a3b906102c5b17b00be651459a459d9bc6a26430f9e9bbbeb
APTAppleSeedCVE-2025-68670CVE-2026-3102Cloud AtlasEDR-killersExifToolKimsukyOceanLotusPebbleDashPowerCloudPyPIReverseSocksSSHSparkCatTorTriadaZiChatBotdata-leak extortionexploitsmobile threatspc threats`,`iot threats`,`suspicious websitesransomwarevulnerabilitiesxrdp
What happened
Kaspersky Securelist items summarise multiple active threats and vulnerability findings from late 2025–early 2026: new Cloud Atlas (aka Turla/related) activity targeting Russian and Belarusian public/diplomatic entities using persistence tools (ReverseSocks, SSH, Tor) and a new payload/tool named PowerCloud; a critical ExifTool vulnerability (CVE-2026-3102) that can be exploited to compromise macOS via crafted images; Q1 2026 mobile and PC/IoT threat reports highlighting new SparkCat and Triada variants; Kimsuky campaigns deploying PebbleDash-based tooling linked to the AppleSeed cluster; an R
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 68817e93169d922a3b906102c5b17b00be651459a459d9bc6a26430f9e9bbbeb
- Enrichment time
- 2026-05-25T08:51:55Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.