New APT Group "CloudSorcerer" Targets Russian Government Entities

Kaspersky discovered a sophisticated APT tracked as CloudSorcerer targeting Russian government entities with a C-based backdoor that dynamically adapts behavior by process context and uses cloud platforms (Microsoft Graph, Yandex Cloud, Dropbox, GitHub and others) as C2 and exfiltration channels; Proofpoint later observed a similar spear-phishing campaign (UNK_ArbitraryAcrobat) targeting a U.S. organization using LNK-laden ZIP lures and hex-encoded blobs tied to the same infrastructure.