{"id":15041,"date":"2014-12-15T19:19:37","date_gmt":"2014-12-15T19:19:37","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=3428"},"modified":"2020-02-27T03:52:05","modified_gmt":"2020-02-26T16:52:05","slug":"partly-cloudy-october-a-spiritual-successor-to-redoctober-apt-revealed","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/partly-cloudy-october-a-spiritual-successor-to-redoctober-apt-revealed\/15041\/","title":{"rendered":"Partly Cloudy October: a spiritual successor to RedOctober APT revealed"},"content":{"rendered":"

Kaspersky Lab\u2019s Global Research & Analysis Team has just disclosed details of months long monitoring of a new APT codenamed \u201cCloud Atlas<\/a>\u201d after the famous film by Vachovsky-Tykwer. This complex cyber-espionage operation is the \u201cspiritual successor\u201d to the RedOctober campaign<\/a>, and most likely has the same people behind it.<\/p>\n

\n<\/p>

The RedOctober operation was hastily wrapped-up just after Kaspersky Lab\u2019s publication in January 2013. Considering its global scope and the large investments behind the campaign, there was no reason to expect that RedOctober would just go away completely.<\/p>\n

Cloud Atlas was first detected in August 2014. Some of Kaspersky Lab\u2019s product users observed targeted attacks with a variation of CVE-2012-0158<\/a> and an unusual set of malware.<\/p>\n

Partly Cloudy October: a spiritual successor to RedOctober #APT revealed<\/p>Tweet<\/a><\/blockquote>\n

The aforementioned vulnerability was present in Windows Common Controls and allowed remote code execution. It affected a large number of Microsoft products, namely 32-bit versions of Microsoft Office 2003, 2007 and 2010, Microsoft SQL Server 2000, 2005, 2008 and 2008 R2, along with Fox Pro, Visal Basic and some other Microsoft server software. This is quite a large attack surface. However, Cloud Atlas\u2019 initial attack vector was spearphishing Microsoft Word docs (with an old .doc filename extension). Most of the docs listed by GReAT have Russian names. However, one of them \u2013 the one that raised suspicions Cloud Atlas may be related to RedOctober \u2013 has the name \u201cCar for sale.doc\u201d. RedOctober used \u201cDiplomatic Car for Sale.doc\u201d.<\/p>\n

Further analysis supported the theory: there are multiple technical similarities, showing that (most likely) the same people who created malware tools for RedOctober did so for Cloud Atlas as well.<\/p>\n

\"wide-2\"<\/a><\/p>\n

Similarities:<\/strong><\/p>\n