Cloud Atlas APT Modifies Windows RDP for Multiple Sessions

Key Takeaways

• The Cloud Atlas APT group is exploiting a sophisticated technique to gain persistent, stealthy access to Windows systems.
• Attackers modify the termsrv.dll file to enable multiple, concurrent Remote Desktop Protocol (RDP) sessions, allowing them to operate undetected alongside legitimate users.
• The group’s tactics have become more advanced, combining phishing, custom malware like VBCloud and PowerShower, and tools like Tor, SSH, and RevSocks for robust stealth and persistence.
• Targets primarily include government and diplomatic organizations, particularly in Russia and Belarus, with heightened activity observed since late 2025 and early 2026.
• Detection is challenging as the method modifies a legitimate system file, and layered persistence mechanisms make eviction difficult.

Cloud Atlas APT Leverages Modified Windows RDP for Covert Multi-Session Access

The advanced persistent threat (APT) group known as Cloud Atlas has been observed deploying a sophisticated method to establish and maintain covert access on Windows operating systems. Cybersecurity researchers recently detailed how the group manipulates the termsrv.dll file, a core component of Windows Remote Desktop Services, to facilitate multiple simultaneous RDP sessions on compromised hosts without detection. This technique allows attackers to maintain unauthorized control and conduct operations in the background, significantly complicating efforts by security teams to identify and mitigate their presence.

Active since at least 2014, Cloud Atlas has intensified its campaigns over the past year, specifically targeting government agencies and diplomatic entities, with a notable focus on organizations in Russia and Belarus. The group’s operational sophistication has evolved, integrating refined phishing tactics with a suite of new tools designed for prolonged stealth.

According to a report by Securelist, shared with Cyber Security News (CSN), the group’s arsenal now includes utilities such as Tor, SSH, and RevSocks, alongside custom malware, making detection particularly challenging. Securelist researchers noted a significant expansion of the group’s toolkit in the latter half of 2025 and early 2026.

Initial Infection and Payload Delivery

The initial compromise typically begins with a carefully crafted phishing email. These emails contain a ZIP archive that, when opened, delivers a malicious shortcut file. Executing this shortcut covertly triggers a PowerShell script downloaded from an external server.

This script orchestrates several critical steps: it establishes persistence on the system, downloads a decoy PDF document to divert the user’s attention, meticulously removes traces of the initial infection, and deploys additional payloads. These payloads include a backdoor dubbed VBCloud and a reconnaissance tool known as PowerShower.

Once inside a network, the Cloud Atlas group executes lateral movement to deploy the termsrv.dll modification. This critical step enables them to maintain access without disconnecting any legitimate, logged-in user, thereby significantly reducing the likelihood of immediate detection.

Cloud Atlas APT Group Modifies termsrv.dll

The linchpin of this campaign is a PowerShell script, identified as rdp_new.ps1, which directly modifies the termsrv.dll file in Windows 10 systems. By default, Windows Remote Desktop Services limits a system to a single concurrent RDP session. The termsrv.dll file governs this behavior.

Before modifying the DLL, the script first adds a firewall rule to permit RDP traffic and eases remote access security configurations. It then takes ownership of termsrv.dll, grants itself full access permissions, and proceeds to replace a specific byte sequence within the file. This alteration effectively removes the default single-session restriction. Following the patch, the RDP service is restarted, and the modification takes effect.

This allows attackers to connect remotely and operate concurrently with a legitimate user, with neither party disrupting the other’s session. The danger of this technique lies in its targeting of a trusted Windows system file, rather than a readily identifiable third-party tool. Consequently, conventional monitoring solutions may fail to flag changes to an existing system DLL, providing attackers with an extended window for undetected operations within the compromised host.

Reverse SSH Tunnels and Layered Persistence

Cloud Atlas enhances its persistence by establishing reverse SSH tunnels in conjunction with the RDP manipulation. A compromised machine initiates an outbound SSH connection to an attacker-controlled server. This technique often bypasses firewall rules designed to block incoming connections, as the activity appears to be normal outbound network traffic to many security monitoring systems.

To ensure these tunnels remain active, the group employs VBS scripts executed via PAExec or PsExec, scheduling them as Windows tasks for automatic restarts. In some instances, Cloud Atlas has also deployed RevSocks, a proxy tool written in Go, and routed RDP access through hidden .onion addresses via Tor. These layered access channels mean that even if one access method is discovered and removed, the attackers retain alternative routes to the compromised machine, making complete eviction significantly more challenging.

What You Should Do

• Monitor termsrv.dll: Implement robust file integrity monitoring (FIM) to detect any unauthorized modifications to the termsrv.dll file.
• Audit Firewall Rules: Regularly review Windows Firewall configurations for new or modified rules that permit RDP traffic or relax security settings.
• Inspect Scheduled Tasks: Periodically audit scheduled tasks for unfamiliar VBS or PowerShell entries that could be used for persistence or tunnel re-establishment.
• Detect Unusual Outbound SSH: Monitor network traffic for unusual outbound SSH connections, particularly from internal hosts that should not be initiating such activity.
• Block Malicious Infrastructure: Implement network perimeter blocking for known malicious IP addresses and domains associated with Cloud Atlas, as provided in the Indicators of Compromise (IoCs) below.
• Enhance Email Security: Strengthen email security gateways to detect and block phishing emails containing malicious ZIP archives and shortcut files.
• User Awareness Training: Conduct regular cybersecurity awareness training for employees to educate them about the dangers of phishing and opening suspicious attachments.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.