Inception
Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.
- ATT&CK ID
- G0100
- Techniques
- 20
- Tools
- 3
Also tracked as Inception Framework · Cloud Atlas
Vulnerabilities it has exploited
- CVE-2012-0158 Microsoft MSCOMCTL.OCXUnscored · exploited in the wild
- CVE-2014-1761 Microsoft WordUnscored · exploited in the wild
- CVE-2017-11882 Microsoft OfficeUnscored · exploited in the wild
- CVE-2018-0802 Microsoft OfficeUnscored · exploited in the wild
Techniques
Resource Development
Initial Access
Execution
Command and Scripting InterpreterExploitation for Client ExecutionUser Execution
Persistence
Boot or Logon Autostart Execution
Privilege Escalation
Boot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationSystem Binary Proxy ExecutionTemplate Injection
Credential Access
Credentials from Password Stores
Discovery
Process DiscoveryPermission Groups DiscoverySystem Information DiscoveryFile and Directory DiscoverySoftware Discovery
Collection
Command and Control
Application Layer ProtocolProxyWeb ServiceEncrypted Channel
Software
LaZagne · PowerShower · VBShower