H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Inception](https://attack.mitre.org/groups/G0100) is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)

25 recorded

Relationships

uses

to Credentials from Web Browsers

Technique

uses

to Data from Local System

Technique

uses

to Domain Groups

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exploitation for Client Execution

Technique

uses

to File and Directory Discovery

Technique

uses

Tool

uses

to Malicious File

Technique

uses

Technique

uses

to Multi-hop Proxy

Technique

uses

Technique

uses

Malware

uses

to Process Discovery

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Software Discovery

Technique

uses

to Spearphishing Attachment

Technique

uses

to Symmetric Cryptography

Technique

uses

to System Information Discovery

Technique

uses

to Template Injection

Technique

uses

Technique

uses

Malware

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

Technique

7 external

References

mitre-attack

G0100

Cloud Atlas

—

Inception

—

Inception Framework

—

Kaspersky Cloud Atlas December 2014

https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/

Unit 42 Inception November 2018

https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/

Symantec Inception Framework March 2018

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies