Recent Cloud Atlas activity

Kaspersky researchers describe recent Cloud Atlas activity: targeted spear-phishing using malicious remote Office templates and a polymorphic HTA/VBS chain that deploys VBShower (validator) and PowerShower (PowerShell backdoor) to load document- and credential-stealing modules and a second-stage modular backdoor. The report includes infection chain diagrams, details of commands and modules, persistence and anti-forensics behaviors, exploited CVEs (CVE-2017-11882, CVE-2018-0802), and IoCs (attacker emails, registry Run key pattern, file paths and C2 IPs).