Inception

Origin🇷🇺 Rússia

Techniques (MITRE ATT&CK)22

SourceMITRE ATT&CK

State sponsor: Russian FederationAttribution confidence: 50%Target categories: Government, Private sector

Targeted regions: Afghanistan · Armenia · Azerbaijan · Belarus · Belgium · Czech Republic · Greece · India · Iran · Italy +11

Also known as:ATK116Blue OdinClean UrsaCloud AtlasG0100Inception FrameworkOXYGEN

About the group

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity59

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 22

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool

Initial access

Spearphishing Attachment

Execution

PowerShell Visual Basic Exploitation for Client Execution Malicious File

Persistence

Registry Run Keys / Startup Folder

Credential access

Credentials from Web Browsers

Discovery

Process Discovery Domain Groups System Information Discovery File and Directory Discovery Software Discovery

Collection

Data from Local System

Command and control

Web Protocols Multi-hop Proxy Web Service Symmetric Cryptography

stealth

Encrypted/Encoded File Mshta Regsvr32 Template Injection

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2012-0158HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2018-0802HIGHEPSS 93%KEV MITRE ATT&CK

CVE-2014-1761HIGHEPSS 77%KEV MITRE ATT&CK

References

Inception uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →