Inception - G0100

Created: 2020-05-08T17:01:04.058Z

Modified: 2021-10-12T23:21:06.480Z

Contributors: Oleg Skulkin, Group-IB

Aliases

Inception,Inception Framework,Cloud Atlas

Description

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)

Techniques Used

Inception has obtained and used open-source tools such as

LaZagne.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Inception has enumerated installed software on compromised systems.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Inception has used malicious HTA files to drop and execute malware.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Inception has used PowerShell to execute malicious commands and payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|