Cloud Atlas: RedOctober APT is back in style - Securelist

**Cloud Atlas** is a targeted cyber-espionage campaign—likely a revival of the RedOctober APT—that uses CVE-2012-0158 Office exploits to deploy polymorphic VBScript loaders and encrypted DLL payloads which communicate over HTTPS/WebDAV using abused cloud storage accounts (cloudme.com); the report provides technical analysis, configuration and C2 artifacts, victim geography (primarily Russia and nearby states), LZMA/AES usage, build-tool similarities to RedOctober, and a list of IoCs and AV detections.