Inception

Names and who uses them

• InceptionOur name
• Cloud AtlasKaspersky
• Inception FrameworkSymantec

Targets

Sectors: Government

Regions: Europe, Middle East, Africa, United States

Known techniques

• T1005Data from Local System
• T1027.013Encrypted/Encoded File
• T1057Process Discovery
• T1059.001PowerShell
• T1059.005Visual Basic
• T1069.002Domain Groups
• T1071.001Web Protocols
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1090.003Multi-hop Proxy
• T1102Web Service
• T1203Exploitation for Client Execution
• T1204.002Malicious File
• T1218.005Mshta
• T1218.010Regsvr32
• T1221Template Injection
• T1518Software Discovery
• T1547.001Registry Run Keys / Startup Folder
• T1555.003Credentials from Web Browsers
• T1566.001Spearphishing Attachment
• T1573.001Symmetric Cryptography
• T1588.002Tool

Malware and tools used