Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Inception Framework · Nation-state · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

Inception Framework

  • Clean Ursa
  • Cloud Atlas
  • OXYGEN
  • G0100
  • ATK116
  • Blue Odin

state sponsor · Russian FederationMITRE G0100 ↗

Inception Framework — ATT&CK roseIF

attack rose · 22 techniques across 9 tactics

Last 30 days

last seen 15 d ago
dispatches4
victims0
CVEs seen0

What changed

ledger · newest first
  1. —todaynew CVE3 new CVEs: CVE-2012-0158, CVE-2017-11882, CVE-2018-0802
  2. —23 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy + mitre-attack

This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.

Observed targets (as stated by the sources)

20 countries · 2 sectors
AfghanistanArmeniaAzerbaijanBelarusBelgiumCzechiaGreeceIndiaIranItalyKazakhstanKenyaMalaysiaRussiaSouth AfricaTurkmenistanUkraineUnited KingdomUnited StatesVietnamAssessed origin: Russia

assessed origin · Russiaobserved targets · 20

countries · 20

  • Afghanistan
  • Armenia
  • Azerbaijan
  • Belarus
  • Belgium
  • Czechia
  • Greece
  • India
  • Iran
  • Italy
  • Kazakhstan
  • Kenya
  • Malaysia
  • Russia
  • South Africa
  • Turkmenistan
  • Ukraine
  • United Kingdom
  • United States
  • Vietnam

sectors · 2

  • Government
  • Private sector

also stated: Suriname

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

22 techniques · 9 of 15 tactics

  1. Resource development

    1 technique

  2. Initial access

    1 technique

  3. Execution

    4 techniques

  4. Persistence

    1 technique

  5. Stealth

    4 techniques

  6. Credential access

    1 technique

  7. Discovery

    5 techniques

  8. Collection

    1 technique

  9. Command and control

    4 techniques

select a technique

Arsenal

2 malware · 1 tools
Malware
Malware · 2ATT&CK
PowerShowerS0441 ↗
VBShowerS0442 ↗
Tools
Tools · 1ATT&CK
LaZagneS0349 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Inception Framework is cited as exploiting

none on KEV
  1. CVE-2012-01582026-10-17
    1. “In August 2014, some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware.”

      cited as exploiting · named nearby · source: securelist.com ↗ · 2026-10-17

  2. CVE-2017-118822026-10-17
    1. “a lure document that exploits CVE-2017-11882, a six-year-old memory corruption flaw in Microsoft Office’s Equation Editor, a technique Cloud Atlas has employed as early as October 2018”

      cited as exploiting · source: ics-cert.kaspersky.com ↗ · 2026-10-17

    2. “Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

  3. CVE-2018-08022026-10-17
    1. “Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.”

      cited as exploiting · source: securelist.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022Cloud Atlas targets entities in Russia and Belarus amid the ongoing war in Ukrainecheckpoint ↗
  2. 2019Recent Cloud Atlas activityKaspersky ↗
  3. 2014The Inception Framework: Cloud-Hosted AptBluecoat ↗
  4. 2014Cloud Atlas: Redoctober Apt Is Back In StyleKaspersky ↗

Take it with you

keyless · no signup

References

24 sources
  1. 1.cfr.org/interactive/cyber-operations/inception-framework
  2. 2.web.archive.org/web/20160710180729/https://www.bluecoat.com/security-b…
  3. 3.paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/Inception_A…
  4. 4.logrhythm.com/blog/catching-the-inception-framework-phishing-attack
  5. 5.paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/bcs_wp_Ince…
  6. 6.securelist.com/the-red-october-campaign/57647
  7. 7.securelist.com/red-october-diplomatic-cyber-attacks-investigation/367…
  8. 8.securelist.com/red-october-part-two-the-modules/57645
  9. 9.securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083
  10. 10.securelist.com/an-undocumented-word-feature-abused-by-attackers/81899
  11. +14 more in the JSON record

Track Inception Framework on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.