Inception

G01006 reports

aliases · Inception · Inception Framework · Cloud Atlas

Reports

Techniques

Tactics

Countries

80%

Hunt coverage

Aliases

Analyst assessment — key judgments

Signature techniques: T1588.006 (Vulnerabilities), T1593.001 (Social Media), T1589.001 (Credentials).
Primary targeting: US, RU.
Activity declining: 0 report(s) in last 30d vs 4 prior (-100%).
Hunt coverage 80% of 5 observed techniques (1 gap(s)).
Assessment confidence: medium (67).

Activity & trend

DecliningLast 30d: 0 vs 4 prior (-100%)· first reported 2025-08-25 · last 2026-06-10

30d

90d

All

0.3

Rpts/wk

Reporting timeline · 12 months

Movement — last 30 days

Dropped (90d+)

T1684AML.T0069.002

Targeting lost

RUUS

Overview

Analyst triage

Intelligence summary

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)

Top co-occurring indicators

Aliases & naming

Targeting · countries

Targeting · named victims

ATT&CK technique matrix

Coverage vs hunt library:

—

Hunt-coverage gaps — prioritized

Top techniques by observation

T1588.006 · Vulnerabilitiesconf 754
evidence: What’s in the SOSS? Podcast #62 – S3E14 The Ghost in the Dependency Tr How Relay Network Adopted AI Coding Securely and Built the Foundation Architecting Security for Agentic Capabilities in Chrome
T1593.001 · Social Mediaconf 703
evidence: Who Runs the Ransomware Group ‘The Gentlemen?’What’s in the SOSS? Podcast #62 – S3E14 The Ghost in the Dependency Tr Architecting Security for Agentic Capabilities in Chrome
T1589.001 · Credentialsconf 703
evidence: Who Runs the Ransomware Group ‘The Gentlemen?’The Deception Redemption Architecting Security for Agentic Capabilities in Chrome
T1684 · Social Engineeringconf 601
evidence: Architecting Security for Agentic Capabilities in Chrome
AML.T0069.002 · System Promptconf 601
evidence: Safeguarding VS Code against prompt injections

Threat catalogue · engineering roadmap0

Flagged detection-engineering queue

Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

Infrastructure

IOC type mix

Tooling / malware families

Relationships

Activity

30-day mention timeline

Recent reporting

Title	Source	Severity	Collected