CloudSorcerer
CloudSorcerer is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets the Government sector in Russia.
- Operation “EastWind”
- Techniques
- 0
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2024
- Last seen
- Aug 1, 2024
- Record updated
Who They Target.
About CloudSorcerer.
In May 2024, we discovered a new advanced persistent threat (APT) targeting Russian government entities that we dubbed CloudSorcerer. It’s a sophisticated cyberespionage tool used for stealth monitoring, data collection, and exfiltration via Microsoft Graph, Yandex Cloud, and Dropbox cloud infrastructure. The malware leverages cloud resources as its command and control (C2) servers, accessing them through APIs using authentication tokens. Additionally, CloudSorcerer uses GitHub as its initial C2 server. CloudSorcerer’s modus operandi is reminiscent of the CloudWizard APT ({{Bad Magic, RedStinger}}) that we reported on in 2023. However, the malware code is completely different. We presume that CloudSorcerer is a new actor that has adopted a similar method of interacting with public cloud services.
Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.