Tag: CVE-2018-0802

4 Attack Reports | 0 Vulnerabilities

Attack reports

Cloud Atlas: Analysis of Phishing Campaign and VBShower Backdoor

The article analyzes a phishing campaign by the Cloud Atlas APT group targeting Russian organizations. It details five successful attacks on the same system over time, using malicious Microsoft Office documents to deliver the VBShower backdoor. The attackers used alternate data streams to hide mali…

microsoft office

alternate data streams

Published: February 23, 2026

Linked vulnerabilities : CVE-2018-0802

Downloadable IOCs: 10

Deep Dive into New XWorm Campaign Utilizing Multiple-Themed Phishing Emails

A sophisticated phishing campaign delivering XWorm RAT has been identified. The attack chain begins with themed emails containing malicious Excel attachments exploiting CVE-2018-0802. When opened, the file downloads an HTA file, which executes PowerShell code to retrieve a fileless .NET module. Thi…

process hollowing

Published: February 10, 2026

Linked vulnerabilities : CVE-2017-11882, CVE-2018-0802

Downloadable IOCs: 8

Cloud Atlas activity in the first half of 2025: what changed

The Cloud Atlas APT group continues to target countries in Eastern Europe and Central Asia using phishing emails with malicious attachments exploiting CVE-2018-0802. The infection chain now includes several implants: VBShower, VBCloud, PowerShower, and CloudAtlas. New and updated components are des…

Published: December 20, 2025

Downloadable IOCs: 0

Cloud Atlas using a new backdoor, VBCloud, to steal data

Cloud Atlas, a threat group active since 2014, has introduced a new backdoor called VBCloud in its latest campaign targeting Eastern Europe and Central Asia. The attack chain begins with phishing emails containing malicious documents exploiting CVE-2018-0802. The infection process involves download…

Published: December 23, 2024

Linked vulnerabilities : CVE-2018-0802

Downloadable IOCs: 16

Click here to see more Attack Reports