Cloud Atlas APT — termsrv.dll Byte-Patch for Multi-Session RDP, PowerCloud/PowerShower/VBCloud Chain, RevSocks + Reverse SSH Tunnels Targeting Russian and Belarusian Government — Threadlinqs Intelligence
As of 2026-05-30, Cloud Atlas APT — termsrv.dll Byte-Patch for Multi-Session RDP, PowerCloud/PowerShower/VBCloud Chain, RevSocks + Reverse SSH Tunnels Targeting Russian and Belarusian Government is a high-severity apt threat attributed to Inception, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 60 indicators of compromise.
Threat ID: TL-2026-0583 · Severity: HIGH · Status: ACTIVE · Category: APT
Attribution: Inception · ESPIONAGE
Securelist (Kaspersky) documents an evolved Cloud Atlas (Inception / Clean Ursa / Blue Odin / G0100) APT campaign active in H2 2025 and into early 2026 targeting Russian and Belarusian government,
Cloud Atlas (also tracked as Inception Framework, Clean Ursa, Blue Odin, Oxygen, ATK116, G0100) is a long-running espionage actor active since at least 2014 with historical overlaps to Red October operations. Kaspersky's Securelist team published two reports in 2025-2026 documenting an evolved campaign against Russian and Belarusian state, diplomatic, construction, telecommunications and manufacturing targets. The 2026 reporting extends the established VBCloud / PowerShower toolkit with three significant new capabilities: PowerCloud (PS2EXE-packaged PowerShell agent that exfiltrates Base64-encoded reconnaissance via authenticated Google Sheets API), large-scale operationalization of RevSocks (a public Go SOCKS5 reverse-proxy from github.com/kost/revsocks) as a long-term traffic-relay implant, and a termsrv.dll patch that converts compromised Windows 10 hosts into multi-session RDP servers.
The access chain begins with spearphishing email carrying a ZIP attachment that holds a malicious .lnk shortcut. When opened, the LNK invokes powershell.exe with -ep bypass to fetch a stage-one script (commonly fixed.ps1 written to %TEMP%) which establishes a Run-key persistence value named YandexBrowser_setup under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, drops and opens a decoy PDF from rar.zip via the default handler, then taskkills winrar.exe and cleans up the archive. The earlier H1 2025 wave used CVE-2018-0802 Equation Editor RCE via malicious RTF templates calling powershell.exe -ep bypass -w 01 %APPDATA%\Adobe\AdobeMon.ps1 with persistence stored as Base64 payload inside HKCU\Console\...::WindowPosition registry values and scheduled tasks named MicrosoftEdgeUpdateTask, MicrosoftAdobeUpdateTaskMachine, and MicrosoftVLCTaskMachine.
VBCloud is delivered as a two-stage VBS payload — video.vbs launches and decrypts video.mds, an RC4-encrypted body that stages a file-stealer targeting .doc, .pdf and .xls documents and pulls additional scripts from C2. PowerShower (Securelist S0441) is written to C:\Users\<user>\Pictures\googleearth.ps1 and performs broad host enumeration: running processes, local administrators, domain controllers, plus a fodhelper.exe UAC bypass to trigger SAM/SECURITY hive theft via Volume Shadow Copy with the hives renamed to .pdf in C:\Users\Public\Documents. PowerShower also performs Kerberoasting / AS-REP roasting (T1558.004) for offline cracking. PowerCloud is the 2026 addition — heavily obfuscated PowerShell wrapped into PE form with PS2EXE and dropped to legitimate-looking Windows directories: C:\Windows\wininet.exe, C:\Windows\LiveKernelReports\update.exe, C:\Windows\ime\imejp\dicts\i39884.exe, and C:\Windows\pla\reports.exe. It enumerates local administrators, collects host metadata, Base64 encodes the result and writes it to a Google Sheet via authenticated Google API — a cloud-as-C2 channel that blends with normal corporate traffic and avoids domain-reputation signals.
The centerpiece of the new tradecraft is rdp_new.ps1 (MD5 1A11B26DD0261EF27A112CE8B361C247). The script issues takeown /F C:\Windows\System32 ermsrv.dll /A and icacls C:\Windows\System32 ermsrv.dll /grant Administrators:F, then patches the byte sequence 39 81 3C 06 00 00 ?? ?? ?? ?? ?? ?? to B8 00 01 00 00 89 81 38 06 00 00 90 inside termsrv.dll. This removes the single-session-per-user restriction enforced by CDFGetBOOLEAN/CDFFinalizeBOOLEAN, allowing concurrent interactive RDP sessions without disconnecting the legitimate user. The script then stops and restarts TermService (sc stop / sc start TermService), adds a Windows Firewall allow rule for TCP/3389 (netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389), and adjusts Terminal Services policy values under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services to relax NLA and remote-connection security. Because the binary file is replaced rather than parameters tweaked, Windows Update may revert the patch on cumulative updates —
Weaknesses (CWE)
CWE-269, CWE-426, CWE-552, CWE-829
Target sectors: government, diplomatic, defense, telecommunications, manufacturing, construction
Target regions: Russia, Belarus, CIS, Eastern Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 60 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
APT, HIGH, threat intelligence, cybersecurity, CVE-2018-0802, T1589, T1583, T1584.001, T1588.002, T1566.001, T1204.002, T1059.001, T1059.005, T1203, T1547.001