FORENSIA

THREAT_ACTOR · G0100

Inception

Also known as: Inception, Inception Framework, Cloud Atlas

Profile

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.

MITRE ATT&CK ↗

Techniques

22 ATT&CK techniques attributed to this actor.

T1005 Data from Local SystemT1027.013 Encrypted/Encoded FileT1057 Process DiscoveryT1059.001 PowerShellT1059.005 Visual BasicT1069.002 Domain GroupsT1071.001 Web ProtocolsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1090.003 Multi-hop ProxyT1102 Web ServiceT1203 Exploitation for Client ExecutionT1204.002 Malicious FileT1218.005 MshtaT1218.010 Regsvr32T1221 Template InjectionT1518 Software DiscoveryT1547.001 Registry Run Keys / Startup FolderT1555.003 Credentials from Web BrowsersT1566.001 Spearphishing AttachmentT1573.001 Symmetric CryptographyT1588.002 Tool

Software

3 malware/tools attributed to this actor.

LaZagnePowerShowerVBShower

Related corpus activity

10,355 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Inception.

IndicatorTypeFamilySevSrc
cve-2026-3102cve—853
cve-2026-1969cve—851
cve-2025-11837cve—852
cve-2014-2321cve—851
cve-2025-2492cve—852
cve-2021-29441cve—851
cve-2026-22584cve—852
cve-2013-3307cve—852
cve-2016-15047cve—854
cve-2018-8007cve—851
cve-2021-4045cve—851
cve-2020-22658cve—852
cve-2017-18377cve—851
cve-2021-25646cve—851
cve-2025-66478cve—852
cve-2025-0921cve—852
cve-2016-5681cve—852
cve-2021-27076cve—851
cve-2025-68670cve—852
cve-2022-47945cve—851
cve-2025-34054cve—854
cve-2024-1781cve—851
cve-2025-23304cve—852
cve-2023-44976cveransomware852
cve-2020-17456cve—851
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2026-4368cveransomware851
cve-2013-7471cve—851
cve-2026-0740cve—851

Showing the top 30 by severity of 10,355.