Threat Actor Characterization
Inception
ID: 25bfef169eafddf29120cd78d9d4a66d15927| Cloud Atlas | Inception Framework | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Inception (a.k.a. Inception Framework / Cloud Atlas) — since 2014, a modular espionage actor using spearphishing attachments and template injection to deliver PowerShell/VB loaders, persisting via Run keys/regsvr32, stealing browser credentials and documents, and communicating over HTTP(S)/WebDAV and cloud services with multi-hop router proxying.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1566.001 | Spearphishing Attachment | TA0001 |
|
| T1221 | Template Injection | TA0005 |
|
| T1203 | Exploitation for Client Execution | TA0002 |
|
| T1059.001 | PowerShell | TA0002 |
|
| T1059.005 | Visual Basic | TA0002 |
|
| T1547.001 | Registry Run Keys / Startup Folder | TA0003 TA0004 |
|
| T1218.010 | Regsvr32 | TA0005 |
|
| T1555.003 | Credentials from Web Browsers | TA0006 |
|
| T1102 | Web Service | TA0011 |
|
| T1090.003 | Multi-hop Proxy | TA0011 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Inception is a long-running espionage actor active since 2014 (and with lineage to Cloud Atlas in 2014–2015) that targets government and multiple industries—primarily in Russia, but with activity across Europe, Asia, Africa, the Middle East, and the U.S. Tooling is modular (PowerShower/VBShower, browser-credential plugins), relies on phishing with weaponized documents and template injection, and favors cloud and WebDAV/HTTP(S) for C2. A characteristic tradecraft element is multi-hop proxying through chains of compromised routers before reaching cloud services, complicating takedown and attribution. Capability: medium-high; OPSEC: mature. Confidence: high on TTPs/targeting.
Vendors label Inception/Cloud Atlas as an information-theft APT with regional focus shifting by campaign. No widely accepted public state attribution; activity is consistent with state-aligned intelligence collection. INFERENCE (medium).