Inception Framework

G0100RUEspionage1 report from 1 vendor· last reported 2026-05-22

This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.

Vendor aliases (7)

The same group is tracked under different names by different vendors.

Vendor	Name
OSINT	Clean Ursa
OSINT	Cloud Atlas
OSINT	OXYGEN
OSINT	G0100
OSINT	ATK116
OSINT	Blue Odin
OSINT	Inception

Targeting

Sectors: Government, Private sector

Victim countries: Afghanistan, Armenia, Azerbaijan, Belarus, Belgium, Czech Republic, Greece, India, Iran, Italy, Kazakhstan, Kenya, Malaysia, Russia, South Africa, Suriname, Turkmenistan, Ukraine, United Kingdom, United States, Vietnam

MITRE ATT&CK techniques (25)

T1005 T1027.013 T1053.005 T1057 T1059.001 T1059.005 T1069.002 T1071.001 T1082 T1083 T1090.003 T1102 T1203 T1204.002 T1218.005 T1218.010 T1221 T1518 T1547.001 T1555.003 T1566.001 T1567.002 T1573.001 T1574.002 T1588.002

Indicators of compromise

domainC:\Users\[username]\Pictures\googleearth.ps1’

domainC:\Users\Public\Documents

hash1A11B26DD0261EF27A112CE8B361C247

hash5329F7BFF9D0D5DB28821B86C26D628F

domainC:\Windows\ime

domainC:\Windows\System32\ime

domainC:\Windows\pla

domainC:\Windows\inf

domainC:\Windows\migration

domainC:\Windows\System32\timecontrolsvc

domainC:\Windows\SKB

domainkaspersky.com

hash7A95360B7E0EB5B107A3D231ABBC541A

domainC:\Windows\wininet.exe

hashC0D1EAA15A2CEFBAB9735787575C8D8E

domainC:\Windows\LiveKernelReports\update.exe

hashD5B38B252CF212A4A32763DE36732D40

domainC:\Windows\ime\imejp\dicts\i39884.exe

hash3C75CEDB1196DF5EAB91F31411ED4B33

domainC:\pla\reports.exe

hash42AC350BFBC5B4EB0FEDBA16C81919C7

domainC:\ProgramData\update_[redacted].exe

hash493B901D1B33EB577DB64AADD948F9CE

domainC:\Windows\migration\wtr\MicrosoftBrowser.exe

hash2CABB721681455DAE1B6A26709DEF453

domainC:\Windows\pla\reports\winlog.exe

hash1B39E86EB772A0E40060B672B7F574F1

domainC:\Windows\System32\timecontrolsvc\vmnetdrv64.exe

hash1D401D6E6FC0B00AAA2C65A0AC0CFD6B

domainC:\Windows\setup\scripts\install\software\activation\aact\dfsvc.exe

hash40A562B8600F843B717BC5951B2E3C29

domainC:\Windows\branding\scat.exe

hashF721A76DEB28FD0B80D27FCE6B8F5016

domainC:\Windows\ime\imekr\dicts\dfsvc.exe

hashD3C8AFD22BAA306FF659DB1FAC28574A

hash6D7B2D1172BBDB7340972D844F6F0717

domainC:\Users\[redacted]\AppData\Local\1c\1cv8\1cv8ud.exe

domainC:\Users\[redacted]\AppData\Local\1c\1cv8\svc.exe

hash9769F43B9DE8D19E803263267FA6D62E

hash63B6BE9AE8D8024A40B200CCCB438F1D

domainC:\Windows\notepad.exe

hash6AA586BCC45CA2E92A4F0EF47E086FA1

domainC:\Windows\splwow32.exe

hashEBA3BCDB19A7E256BF8E2CC5B9C1CCA9

domainC:\Users\[redacted]\Desktop\soc\stant.exe

hashB4E183627B7399006C1BC47B3711E419

domainC:\WINDOWS\ime\service.exe

hashF56B31A4B47AD3365B18A7E922FBA1A8

hashF6F62456FB0FCC396FB654CBED339BC3

hash25C8ED0511375DCA57EF136AC3FA0CCA

domainC:\branding\dwmw.exe

domainC:\ProgramData\checker_[redacted].exe

hash2B4BA4FACF8C299749771A3A4369782E

domainC:\Windows\PLA\System\bounce.exe

domainC:\Windows\pla\print_status.exe

hashBA9CE06641067742F2AFC9691FAFF1DC

domainC:\ProgramData\hp\client.exe

hashFB0F8027ACF1B1E47E07A63D8812ED50

hashBBF1FA694122E07635DEEAC11AD712F8

domainC:\Windows\System32\HostManagement.exe

hashF301AA3D62B5095EEC4D8E34201A4769

domainC:\Windows\ime\imejp\msfu.exe

hashF9C3BBE108566D1A6B070F9C5FB03160

domainC:\Windows\ime\imetc\help\IMTCEN14.exe

hash369B75BDCDED16469EDE7AB8BEDCFAE1

hash9EAAE9491F6A50D6DF0BE393734A44CB

hash3E6E9DF00A764B348EC611EE8504ACA0

hash9BD788F285E32A05E6591D1EB36EBFFC

hashF42085522EC2EBB16EDCF814E7C330AD

hash2042EB5D52F0B535A1CE6B6F954C8C2B

hash2AA1E9765EF6B00B94A9B6BE0041436A

hash36120F5E9411BCBAC7104EF3FA964ED2

hash5000A353399500BC78381DC95B6ED2DC

hash579A9952D31CAD801A3988DBE7914CE7

hash867B634588C0FD6B26684D502C15AB03

hash38FA4306FA4406BA31CF171AF4D36E34

hash83EDDE9F7EEEFAC0363413972F35572B

hashCC751619BFEC0DC4607C17112B9E3B2C

hashA632858F14B36F03D0F213F5F5D6BFF2

hash097CA205AD9E3B72018750280904718C

hash69121C36EB8BF77962DCA825FCFFD873

hashC5702EB250F855C8C872FFFB9BB656ED

hashED34F5A136FBA4FDEA976570FAA33ED7

hash0577DB70844E88B32B954906E2F20798

hash28ECF8FB6719E14231B94B4D37629B0E

hash0857C84B62289A1A9F29E19244E9A499

hash0C514E137860F489E3801213460EF938

hash50568B1F9335A7E3BA4E5DF035A8FB86

hash7F776AD200287D6DE14A29158C457179

hash51F7F794ED43FB90D0F8EBBB5EFFE628

hashB8C753DD254509FBA5077FFD5067EAB0

hashBC3739DEC8CD8F54F3F60A85F3ED600E

hashEC076CD21C483A40156F4E40D08DADED

hash216CB7F31D383C0DD892B284DF05A495

hash116F59E70A9DF97F4ADAEA71EECB1E9A

hash7242AC065B50BCDE9308756B49DBADCB

hash8158552950D2E13B075001CE0C52AA97

hashA75DBED984963B9AB21309C5B2F8FD9B

hash0320DD389FDBAB25D46792BD2817675E

hash5339D1A666F3E40FE756505CF1D87D4B

hash67D7E3AEEB673BF60C59361C12A4ED81

hash89572F0ED20791A5AC9FC4267D67CCB0

hashB6AAE073E7BFEBF4D643C2BBEB5C02E1

hash344CA9EA07CD4AC90EF27F8890D4EC05

domaintenkoff.org

domaingoverru.com

domainkufar.org

domainultimatecore.net

domainspbnews.net

domainonedrivesupport.net

domainamerikastaj.com

domainpaleturquoise-dragonfly-364512.hostingersite.com

domainwizzifi.com

domaintotallegacy.org

domainmamurjor.com

domainlandscapeuganda.com

domainkommando.live

domaininternationalcommoditiesllc.com

domainfishingflytackle.com

domainfirsai.tipshub.net

domainalnakhlah.com

domainallgoodsdirect.com

domainagenciakharis.com

domainistochnik.org

domainznews.net

domaininvestika-club.com

ipv4194.102.104.207

ipv446.17.45.56

ipv446.17.45.49

ipv446.17.44.125

ipv446.17.44.212

ipv4185.22.154.73

ipv4194.87.196.163

ipv4195.58.49.9

ipv493.125.114.193

ipv493.125.114.57

ipv445.87.219.116

ipv437.228.129.224

ipv4185.53.179.136

ipv4185.126.239.77

ipv45.181.21.75

ipv4146.70.53.171

ipv445.15.65.134

ipv4185.250.181.207

ipv481.30.105.71

domainC:\Windows\INF\Run.vbs

domainC:\Windows\INF\GenK.vbs

domainC:\Windows\Resources\Update\Intel.exe

domainC:\Windows\INF\package.exe

Top 149 by how many reports mention them.

Report timeline

Every report in the Global Intel Library that names Inception Framework, newest first. Open any report to see the full analysis with provenance.

Kaspersky2026-05-22
Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
T1059.001T1566.001T1071.001T1547.001T1574.002T1053.005T1567.002
original

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Inception Framework. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (24)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

attack.mitre.orghttps://attack.mitre.org/groups/G0100
securelist.comhttps://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/
symantec-enterprise-blogs.security.comhttps://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/
cfr.orghttps://www.cfr.org/interactive/cyber-operations/inception-framework
web.archive.orghttps://web.archive.org/web/20160710180729/https://www.bluecoat.com/security-blog/2014-12-09/blue-coat-exposes-%E2%80%9C-inception-framework%E2%80%9D-very-sophisticated-layered-malware
paper.seebug.orghttps://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/Inception_APT_Analysis_Bluecoat.pdf
logrhythm.comhttps://logrhythm.com/blog/catching-the-inception-framework-phishing-attack
paper.seebug.orghttps://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2014/bcs_wp_InceptionReport_EN_v12914.pdf
securelist.comhttps://securelist.com/the-red-october-campaign/57647
securelist.comhttps://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740
securelist.comhttps://securelist.com/red-october-part-two-the-modules/57645
securelist.comhttps://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083
securelist.comhttps://securelist.com/an-undocumented-word-feature-abused-by-attackers/81899
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability
securelist.comhttps://securelist.com/recent-cloud-atlas-activity/92016
symantec.comhttps://www.symantec.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies
akamai.comhttps://www.akamai.com/uk/en/multimedia/documents/white-paper/upnproxy-blackhat-proxies-via-nat-injections-white-paper.pdf
pwc.co.ukhttps://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf
pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf
pwc.comhttps://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-report-download.pdf
unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/atoms/clean-ursa
cfr.orghttps://www.cfr.org/interactive/cyber-operations/cloud-atlas
cfr.orghttps://www.cfr.org/cyber-operations/red-october