Inception

Introduction

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East. Unit 42 Inception November 2018 Symantec Inception Framework March 2018 Kaspersky Cloud Atlas December 2014

Activities and Tactics

Targeted Sectors: Government, Private sector

Country of Origin: 🇷🇺 Russia

First Seen: 2015

Last Activity: 2015

Incident Type: Espionage

Suspected Victims: Afghanistan, Armenia, Azerbaijan, Belarus, Belgium, Czech Republic, Greece, India, Iran, Italy…

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1027.013 Encrypted/Encoded File
• T1588.002 Tool
• T1547.001 Registry Run Keys / Startup Folder
• T1102 Web Service
• T1090.003 Multi-hop Proxy
• T1518 Software Discovery
• T1083 File and Directory Discovery
• T1566.001 Spearphishing Attachment
• T1082 System Information Discovery
• T1059.001 PowerShell
• T1204.002 Malicious File
• T1071.001 Web Protocols
• T1005 Data from Local System
• T1218.005 Mshta
• T1555.003 Credentials from Web Browsers
• T1203 Exploitation for Client Execution
• T1069.002 Domain Groups
• T1059.005 Visual Basic
• T1221 Template Injection
• T1218.010 Regsvr32
• T1573.001 Symmetric Cryptography
• T1057 Process Discovery

ATT&CK technique IDs (denormalized)

• T1005
• T1027.013
• T1057
• T1059.001
• T1059.005
• T1069.002
• T1071.001
• T1082
• T1083
• T1090.003
• T1102
• T1203
• T1204.002
• T1218.005
• T1218.010
• T1221
• T1518
• T1547.001
• T1555.003
• T1566.001
• T1573.001
• T1588.002

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• CloudDuke:
• CyberGate:
• Cyber Eye RAT:
• UNITEDRAKE:

MITRE ATT&CK Software

• PowerShower (S0441) — malware
• VBShower (S0442) — malware
• LaZagne (S0349) — tool

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [5] Kaspersky Cloud Atlas December 2014 GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020. [6] Unit 42 Inception November 2018 Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020. [7] Symantec Inception Framework March 2018 Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.