InceptionThreat actor
- atk116
- blue odin
- clean ursa
- Cloud Atlas
- g0100
- inception framework
Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.From MITRE ATT&CK
Last reported 2 months ago, by Recorded Future1 report
Suspected originRussiaMISP Galaxy
Targets sectorsGovernmentMISP Galaxy
Targets countriesAfghanistan, Armenia, Azerbaijan, Belarus, Belgium, Czechia, Greece, India, Iran, Italy, Kazakhstan, Kenya, Malaysia, Russia, South Africa, Suriname, Turkmenistan, Ukraine, United Kingdom, United States, VietnamMISP Galaxy
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
July 2026 CVE Landscape“In July 2026, the Dysphoria botnet was used to exploit known IoT and embedded-device flaws to build DDoS and relay infrastructure; Cloud Atlas abused Microsoft Equation Editor to deliver CloudAtlasGo; Armored Likho used a malicious Windows shortcut to deploy BusySnake Stealer; an…”
Indicators in its reports
named in the reports above- joomlacontenteditor[.]netin 1 report
Copy this indicator · defanged
Thanks — we review every report.