Inception

APT / StateG0100
Origin🇷🇺 Rússia
Techniques (MITRE ATT&CK)22
SourceMITRE ATT&CK
State sponsor: Russian FederationAttribution confidence: 50%Target categories: Government, Private sector
Targeted regions: Afghanistan · Armenia · Azerbaijan · Belarus · Belgium · Czech Republic · Greece · India · Iran · Italy +11
Also known as:ATK116Blue OdinClean UrsaCloud AtlasG0100Inception FrameworkOXYGEN

Vexday analysis

Grupo de espionagem cibernética de origem russa, ativo pelo menos desde 2014, rastreado pelo MITRE ATT&CK como G0100 e também referenciado pelos nomes Inception Framework e Cloud Atlas. Suas operações têm como alvo principal entidades governamentais e múltiplos setores industriais na Rússia, com atividade documentada também nos Estados Unidos, Europa, Ásia, África e Oriente Médio. O grupo possui 22 técnicas mapeadas na base ATT&CK e é associado à exploração de 4 CVEs.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity59
Impact: High
T1566.001T1059.001T1547.001T1555.003T1057ENTRYInitial accessSpearphishingAttachmentEXECExecutionPowerShellPERSPersistenceRegistry Run Keys/ Startup FolderCREDCredential accessCredentials fromWeb BrowsersDISCDiscoveryProcess DiscoveryCOLLCollectionData from LocalSystem

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Exploited vulnerabilities 4

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

Inception uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →