{
  "family": "cloudguard",
  "sample_count": 14,
  "category": "pua",
  "description": "CloudGuard (classified across antivirus vendors under designations including PUA:Win32/CloudGuard and Rogue:Win32/CloudGuard) is a rogue PC optimization and security scareware program that deceives Windows users into purchasing fraudulent licenses. Distributed via pay-per-install freeware bundles and deceptive pop-up advertisements, CloudGuard performs fabricated system scans upon installation. It intentionally reports non-existent malware infections, outdated drivers, and harmless temporary files as critical security vulnerabilities. The software locks its cleanup functionality behind an expensive payment wall and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run to continually display intrusive warning banners and nag screens.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/CloudGuard",
    "Rogue:Win32/CloudGuard",
    "Program:Win32/CloudGuard",
    "CloudGuard Antivirus",
    "Win32/CloudGuard"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/CloudGuard?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CloudGuard is a scareware and potentially unwanted application that uses exaggerated error reports to sell fraudulent software licenses."
      }
    },
    {
      "@type": "Question",
      "name": "Are the infections detected by CloudGuard real?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. CloudGuard flags ordinary browser caches, benign registry entries, and standard temporary files as severe security hazards."
      }
    },
    {
      "@type": "Question",
      "name": "How does CloudGuard get installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through deceptive freeware installers, rogue download managers, and fake online malware scan alerts."
      }
    },
    {
      "@type": "Question",
      "name": "How does CloudGuard persist on the system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries in Windows Run keys and registers daily scheduled tasks to display nag screens."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely uninstall CloudGuard?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application via Windows Settings, delete residual folders in %ProgramFiles% and %AppData%, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1491",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1491",
      "name": "Defacement (UI Manipulation)",
      "tactic": "Impact"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the end-user NOT to pay the requested fee; the reported system errors and malware infections are fabricated to induce panic.",
    "Use the Windows Control Panel to uninstall the rogue application, but do not assume this fully cleans the system.",
    "Deploy a reputable enterprise anti-malware or adware removal tool (e.g., Malwarebytes, AdwCleaner) to locate and delete the hidden registry keys and scheduled tasks left behind by the uninstaller.",
    "Review browser configurations to ensure no rogue extensions or homepage hijackers were installed alongside the scareware."
  ],
  "what_to_avoid": [
    "Do not input any credit card or personal information into the software's payment portal.",
    "Avoid ignoring the incident; if the user installed this, they may have unknowingly installed more severe malware from the same bundled package."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/CloudGuard",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/CloudGuard"
    },
    {
      "name": "Malwarebytes Labs - Rogue.CloudGuard Analysis",
      "url": "https://www.malwarebytes.com/blog/detections/rogue-cloudguard"
    },
    {
      "name": "MITRE ATT&CK - Defacement: Displaying Fake Security Alerts (T1491)",
      "url": "https://attack.mitre.org/techniques/T1491/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}