Kaspersky discovered CloudAtlasGo a new Golang backdoor used by the Cloud Atlas APT group that abuses WebRTC for encrypted peer to peer command and control and uses Trello API to exchange SDP signaling messages making it nearly invisible to traditional network monitoring.
Picture a government network defender watching their firewall logs and seeing nothing but normal traffic to Trello the project management tool their team uses every day. No suspicious domains. No known malicious IPs. No unusual ports.
Yet somewhere inside that network a new backdoor named CloudAtlasGo quietly exchanges commands with a remote attacker using WebRTC technology borrowed from video conferencing and SDP messages hidden inside a Trello card description.
That is the exact scenario Kaspersky documented in July 2026 when they discovered the Cloud Atlas APT group had fundamentally changed their command and control architecture while keeping the rest of their attack chain completely familiar.
CloudAtlasGo WebRTC Trello SDP Technical Explanation
Cloud Atlas has operated as a sophisticated espionage group since at least 2014 and historically specialized in PowerShell and VBScript based backdoors targeting government organizations and diplomatic institutions primarily in Russia and Belarus. Kaspersky researchers first detected this new Golang based backdoor in early May 2026 and named it CloudAtlasGo to reflect both its origin and its primary architectural innovation.
The infection chain that delivers CloudAtlasGo deliberately reuses the groups well documented previous workflow. Phishing emails carry malicious documents that exploit CVE 2018 0802 a Microsoft Equation Editor vulnerability that has remained relevant in targeted attack chains for years because many organizations still run unpatched Office deployments.
Opening the document triggers a remote template fetch bringing down a malicious RTF file from attacker controlled infrastructure. That RTF contains the Equation Editor exploit which then downloads and executes an HTA application file.
The HTA drops and installs VBShower a persistent VBScript backdoor which in most cases loads PowerShower a PowerShell backdoor used for network reconnaissance credential harvesting and document theft. Only in select high value intrusions does the chain continue to deliver CloudAtlasGo as a third stage payload sitting just above ten megabytes as a compiled Go executable.
The technical innovation that makes CloudAtlasGo significant sits entirely in how it communicates with its operators. The backdoor traces its origins to an open source GitHub project originally built as a SOCKS5 proxy that used WebRTC for peer to peer communication. Cloud Atlas took that project restructured it and added file upload download command execution and crucially a cloud service signaling layer to complete the WebRTC connection establishment process.
WebRTC requires what the standard calls signaling before two parties can establish a direct encrypted peer to peer data channel. Signaling involves exchanging Session Description Protocol messages where both sides describe their network capabilities and negotiated parameters.
The WebRTC standard deliberately leaves signaling unspecified meaning any communication channel can carry the SDP offer and answer messages. Cloud Atlas chose Trello as that signaling channel making the initial connection establishment look like ordinary project management traffic from any network monitoring perspective.
The backdoor accesses a Trello project board through the official Trello API and reads a card description that contains a Base64 encoded string. After decoding that string the backdoor decrypts it using AES and then decompresses it with Brotli yielding a JSON structure containing the SDP Offer message along with ICE server configuration details needed to punch through NAT and establish the actual WebRTC peer to peer channel.
The backdoor then publishes its SDP Answer back to the same Trello card description through another API call completing the WebRTC handshake from inside the victim network through what looks like a normal authenticated API request to a legitimate business tool.
Once the WebRTC data channel establishes the backdoor supports six distinct labeled channels for different operation types. The remote channel carries commands including file upload download directory listing navigation file manipulation system information retrieval network scanning and program execution.
The dns channel lets the attacker resolve domains through the victim network using the infected system as a proxy. The rportfwd channel opens local ports on the infected system and forwards incoming connections back to the attacker useful for reaching other systems on the same internal network. The cmdqueue channel queues commands for sequential execution while the control channel sends keepalive messages to maintain the connection.
Beyond Trello the backdoor also supports WebDAV and SFTP as alternative signaling channels where it reads and writes files named offer.txt and answer.txt to exchange SDP messages. The choice of signaling channel and file names sit in an embedded YAML configuration file that gets decrypted at runtime along with the cloud service credentials needed for authentication.
Before any of this runs the backdoor performs anti analysis checks looking for virtual machine artifacts sandbox indicators and debugging presence and terminates itself if it detects any of those environments.
CloudAtlasGo Detection IOCs And Defense Mitigation Guide
The detection challenge that CloudAtlasGo presents goes well beyond identifying a suspicious binary. Once the WebRTC channel establishes the command and control traffic flows through an encrypted peer to peer connection between the victim machine and the attacker without passing through any traditional proxy server or domain that appears on threat feeds.
The Trello API calls that bootstrap the connection come from the official Trello domains using legitimate authentication tokens meaning URL filtering and domain reputation systems produce no alert.
Network defenders should monitor for unusual patterns of Trello API access specifically looking for systems that access Trello API endpoints but have no corresponding Trello desktop or browser application running alongside those API calls.
A compiled Go executable making authenticated Trello API requests without any browser session represents a strong anomaly signal. Security teams should also monitor for WebRTC data channel establishment outside of browser processes since legitimate WebRTC usage on an enterprise endpoint almost always originates from a browser or a known conferencing application rather than from a standalone executable in a system path.
The netscan command built into the CloudAtlasGo command set provides another behavioral detection opportunity. When the backdoor operator runs netscan the infected system begins probing IP addresses across detected subnets checking accessibility of ports 22 80 135 139 443 445 3389 and 5985.
That specific combination of ports covering SSH HTTP RPC SMB HTTPS RDP and WinRM represents a recognizable lateral movement reconnaissance pattern that network detection tools can flag when it originates from a workstation rather than from an authorized scanning system.
For organizations tracking this specific campaign the confirmed CloudAtlasGo file hashes provide endpoint detection anchors.
The samples Kaspersky identified carry MD5 values of 26BC6B5A76DFD760D7920BB1C952DB98 for WebAccess.exe 3607985A148743AE3D1F60A6D762E95C for ttsvr.exe 3FBFD9ECD3C63C24692FEB6A7D6DF246 for PhotoAcqsl.exe and 77636EA677782DB380E314C5F2DFBB63 for wsstr.exe.
The file names themselves follow a pattern of impersonating legitimate system utilities with PhotoAcqsl.exe mimicking photo acquisition services and wsstr.exe mimicking Windows components.
The CVE 2018 0802 delivery mechanism that brings CloudAtlasGo to victim machines in the first place remains patchable. Any organization that has not deployed the February 2018 Microsoft Office security updates remains vulnerable to the initial infection vector despite the exploit being nearly eight years old.
Disabling Equation Editor entirely through registry modification for organizations that have no legitimate need for it removes the delivery path completely regardless of patch status.The Cloud Atlas groups decision to keep their initial infection chain unchanged while fundamentally replacing their command and control architecture carries an important strategic message for defenders.
Organizations that built detection around PowerShower or VBShower behavioral patterns now face a third stage payload that looks nothing like those earlier tools while still arriving through the same phishing documents exploiting the same Office vulnerability.
Threat hunting teams should treat known initial access indicators as signals to search for third stage payloads they have never seen before rather than assuming the known toolset represents the full extent of any active intrusion.
