CloudSorcerer

Reports per quarter

Techniques seen in the last two years

• T1091 1 report
• T1189 1 report
• T1190 1 report
• T1212 1 report
• T1566.001 1 report
• T1566.002 1 report
• T1659 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2024-36991
• CVE-2024-38080 KEV
• CVE-2024-38112 KEV
• CVE-2024-4885 KEV
• CVE-2024-7262 KEV
• CVE-2024-7263
• CVE-2025-0994 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 5 May 2026

   UAT-8302 and its box full of malware

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor UAT-8302 and its box full of malware

2. 6 April 2026

   EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor EastWind campaign: new CloudSorcerer attacks on government organizations in Russia

3. 7 November 2024

   ESET APT Activity Report Q2 2024-Q3 2024

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor ESET APT Activity Report Q2 2024-Q3 2024

4. 10 July 2024

   Risky Biz News: US takes down RT's Twitter bot farm

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Risky Biz News: US takes down RT's Twitter bot farm

5. 8 July 2024

   CloudSorcerer – A new APT targeting Russian government entities

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor CloudSorcerer – A new APT targeting Russian government entities

Newest first. Details opens the report in Explore.