G0100: Inception

G0100: Inception describes [Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)

Executive priority

G0100: Inception is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0100: Inception by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata

Detection direction

Validate whether G0100: Inception appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Inception

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques22 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.[3]
Enterprise	T1588.002	ToolSub-technique	Inception has obtained and used open-source tools such as LaZagne.CitationKaspersky Cloud Atlas August 2019
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Inception has maintained persistence by modifying Registry run key value `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\`.[3]
Enterprise	T1102	Web Service	Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.[3][2]
Enterprise	T1090.003	Multi-hop ProxySub-technique	Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.[2]
Enterprise	T1518	Software Discovery	Inception has enumerated installed software on compromised systems.[2]
Enterprise	T1083	File and Directory Discovery	Inception used a file listing plugin to collect information about file and directories both on local and remote drives.[2]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.[3][2][1]CitationKaspersky Cloud Atlas August 2019
Enterprise	T1082	System Information Discovery	Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.[2]
Enterprise	T1059.001	PowerShellSub-technique	Inception has used PowerShell to execute malicious commands and payloads.[1][3]
Enterprise	T1204.002	Malicious FileSub-technique	Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.[3]CitationKaspersky Cloud Atlas August 2019[2][1]
Enterprise	T1071.001	Web ProtocolsSub-technique	Inception has used HTTP, HTTPS, and WebDav in network communications.[3][1]
Enterprise	T1005	Data from Local System	Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.CitationKaspersky Cloud Atlas August 2019
Enterprise	T1218.005	MshtaSub-technique	Inception has used malicious HTA files to drop and execute malware.CitationKaspersky Cloud Atlas August 2019
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.[2]
Enterprise	T1203	Exploitation for Client Execution	Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.CitationKaspersky Cloud Atlas August 2019[3][2][1]
Enterprise	T1069.002	Domain GroupsSub-technique	Inception has used specific malware modules to gather domain membership.[2]
Enterprise	T1059.005	Visual BasicSub-technique	Inception has used VBScript to execute malicious commands and payloads.[1][3]
Enterprise	T1221	Template Injection	Inception has used decoy documents to load malicious remote payloads via HTTP.[1]
Enterprise	T1218.010	Regsvr32Sub-technique	Inception has ensured persistence at system boot by setting the value `regsvr32 %path%\ctfmonrn.dll /s`.[3]
Enterprise	T1573.001	Symmetric CryptographySub-technique	Inception has encrypted network communications with AES.[3]
Enterprise	T1057	Process Discovery	Inception has used a reconnaissance module to identify active processes and other associated loaded modules.[2]

Associated objects

Groups, software, and campaigns

S0441: PowerShower

PowerShower is a PowerShell backdoor used by Inception for initial reconnaissance and to download and execute second stage payloads.[1][2]

Windows

S0442: VBShower

VBShower is a backdoor that has been used by Inception since at least 2019. VBShower has been used as a downloader for second stage payloads, including PowerShower.[1]

Windows

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.2
Created: May 8, 2020, 17:01 UTC (UTC+00:00)
Modified: Jul 31, 2026, 18:48 UTC (UTC+00:00)
Raw hash: 538c8c503fd44bad...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.2	Jul 31, 2026, 18:48 UTC (UTC+00:00)	Current bundle	`538c8c503fd4…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.2	Jul 31, 2026, 18:48 UTC (UTC+00:00)	Older bundle	`538c8c503fd4…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.2	Apr 11, 2024, 02:15 UTC (UTC+00:00)	Older bundle	`95cfebfb6178…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Unit 42 Inception November 2018
Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.
Open source URL
[2]
Symantec Inception Framework March 2018
Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.
Open source URL
[3]
Kaspersky Cloud Atlas December 2014
GReAT. (2014, December 10). Cloud Atlas: RedOctober APT is back in style. Retrieved May 8, 2020.
Open source URL
[4]
Cloud Atlas
(Citation: Kaspersky Cloud Atlas December 2014)
[5]
Inception
(Citation: Symantec Inception Framework March 2018)
[6]
Inception Framework
(Citation: Symantec Inception Framework March 2018)
[7]
mitre-attackG0100
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use