Home / Threat actors / Inception
Inception G0100
Also known as: Inception Framework, Cloud Atlas
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
4
associated CVEs
23
Techniques
3
Malware and tools
Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.”
“Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.”
“Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.”
“Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.”
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1566.001 Spearphishing Attachment Execution
T1059.001 PowerShellT1059.005 Visual BasicT1203 Exploitation for Client ExecutionT1204.002 Malicious File Persistence
T1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder Stealth
T1027.013 Encrypted/Encoded FileT1218.005 MshtaT1218.010 Regsvr32T1221 Template Injection Credential Access
T1555.003 Credentials from Web Browsers Discovery
T1057 Process DiscoveryT1069.002 Domain GroupsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1518 Software Discovery Collection
T1005 Data from Local System Command and Control
T1071.001 Web ProtocolsT1090.003 Multi-hop ProxyT1102 Web ServiceT1573.001 Symmetric Cryptography Malware and tools
- PowerShowerMalwareS0441
- VBShowerMalwareS0442
- LaZagneToolS0349
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.