Inception Framework
No sourced public emblem in this profile.
reference profile · reported nexus: RU (not nationality)
This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.
Source-reported aliases: Clean Ursa, Cloud Atlas, OXYGEN, G0100, ATK116, Blue Odin. Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
Afghanistan · 
Armenia · 
Azerbaijan · 
Belarus · 
Belgium · 
Czech Republic · 
Greece · 
India · 
Iran · 
Italy · 
Kazakhstan · 
Kenya · 
Malaysia · 
Russia · 
South Africa · 
Suriname · 
Turkmenistan · 
Ukraine · 
United Kingdom · 
United States of America · 
Vietnam
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.
References
https://www.cfr.org/interactive/cyber-operations/inception-framework
https://logrhythm.com/blog/catching-the-inception-framework-phishing-attack
https://securelist.com/the-red-october-campaign/57647
https://securelist.com/red-october-diplomatic-cyber-attacks-investigation/36740
https://securelist.com/red-october-part-two-the-modules/57645
https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083
https://securelist.com/an-undocumented-word-feature-abused-by-attackers/81899
https://securelist.com/recent-cloud-atlas-activity/92016
https://www.symantec.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies
https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf