Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.123
- Unit 42 Inception November 2018
- Symantec Inception Framework March 2018
- Kaspersky Cloud Atlas December 2014
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1027.013 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.003 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1221 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.010 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.001 | 2020 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2020 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1069.002 | Domain Groups | — |
| T1071.001 | Web Protocols | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1090.003 | Multi-hop Proxy | — |
| T1102 | Web Service | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1218.010 | Regsvr32 | — |
| T1221 | Template Injection | — |
| T1518 | Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1555.003 | Credentials from Web Browsers | — |
| T1566.001 | Spearphishing Attachment | — |
| T1573.001 | Symmetric Cryptography | — |
| T1588.002 | Tool | — |
Aliases
Cloud Atlas · Inception · Inception Framework
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.