Inception Framework
threat actorRU01
also known as
Other names and identifiers for this entity.
ATT&CK
Cloud Atlas · Inception · Inception Framework
MISP
ATK116 · Blue Odin · Clean Ursa · Cloud Atlas · Inception Framework · OXYGEN
This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.
02
resolved ATT&CK groups
Threat groups associated with this.
03
techniques used (22)
ATT&CK techniques this enables or maps to.
showing 20 of 22
04
software used (3)
Malware and tools associated with this.
05
references
External citations — patches, advisories, analysis.
- https://www.cfr.org/interactive/cyber-operations/inception-framework
- https://web.archive.org/web/20160710180729/https://www.bluecoat.com/security-blog/2014-12-09/blue-coat-exposes-%E2%80%9C-inception-framework%E2%80%9D-very-sophisticated-layered-malware
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/Inception_APT_Analysis_Bluecoat.pdf
- https://logrhythm.com/blog/catching-the-inception-framework-phishing-attack
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/bcs_wp_InceptionReport_EN_v12914.pdf
- https://securelist.com/the-red-october-campaign/57647
- https://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740
- https://securelist.com/red-october-part-two-the-modules/57645