RURussian Federationconfidence: 50
Inception FrameworkInception Framework
Also known as: Clean Ursa · Cloud Atlas · OXYGEN · G0100 · ATK116 · Blue Odin · Inception Framework
Origin
RU
Known aliases
7
Target sectors
2
Attribution
State-sponsored
Profile
This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.
Aliases· 7
Clean UrsaCloud AtlasOXYGENATK116Blue OdinInception Framework
Target sectors· 2
GovernmentPrivate sector
Known victims· 21
- Afghanistan
- Armenia
- Azerbaijan
- Belarus
- Belgium
- Czech Republic
- Greece
- India
- Iran
- Italy
- Kazakhstan
- Kenya
References
- https://www.cfr.org/interactive/cyber-operations/inception-framework
- https://web.archive.org/web/20160710180729/https://www.bluecoat.com/security-blog/2014-12-09/blue-coat-exposes-%E2%80%9C-inception-framework%E2%80%9D-very-sophisticated-layered-malware
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/Inception_APT_Analysis_Bluecoat.pdf
- https://logrhythm.com/blog/catching-the-inception-framework-phishing-attack
- https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/bcs_wp_InceptionReport_EN_v12914.pdf
- https://securelist.com/the-red-october-campaign/57647
- https://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740
- https://securelist.com/red-october-part-two-the-modules/57645
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.