Inception
Cloud Atlas, also referred to as Inception and Inception Framework, is a cyber-espionage threat actor active since at least 2014. The group targets Eastern Europe and Central Asia, and reporting cited in the content notes that in 2024 observed victims were concentrated in Russia, with additional isolated cases in Belarus, Canada, Moldova, Israel, Kyrgyzstan, Vietnam, and Turkey. Separate reporting in late 2025 through early 2026 describes targeting of government agencies and diplomatic organizations, particularly in Russia and Belarus. The group is associated with phishing-based initial access, including spearphishing emails with weaponized documents and malicious files that lure victims into execution. Reported infection chains included documents exploiting CVE-2018-0802 in Microsoft Equation Editor to deliver HTA/VBS payloads. Cloud Atlas used VBShower as a backdoor and downloader, PowerShower for PowerShell-based reconnaissance and follow-on activity, and VBCloud for reconnaissance, collection, and exfiltration. Observed tradecraft includes persistence via modification of HKCU\Software\Microsoft\Windows\CurrentVersion\Run and, in other reporting, scheduled tasks. The actor has used reconnaissance modules to gather operating system and hardware information, identify active processes and loaded modules, and enumerate files and directories on local and remote drives. It used file-hunting plugins to collect documents such as .txt, .pdf, .xls, and .doc files. VBCloud was reported to collect disk and system information, recent files with document/archive extensions, and Telegram-related files. Cloud Atlas has stolen browser passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex, and has used open-source tooling including LaZagne. PowerShower activity included Active Directory and host reconnaissance, dictionary attacks on user accounts, Kerberoasting via PowerSploit, administrator group enumeration, domain controller discovery, ProgramData file enumeration, account policy collection, and use of Inveigh for credential or hash collection. For command and control and data movement, the actor has used HTTP, HTTPS, and WebDAV. Reporting states that VBCloud used public cloud storage over WebDAV as its C2 channel, downloading tasking from cloud directories and deleting tasking files after retrieval. The group also used chains of compromised routers to proxy communications between operators and cloud service providers. In later reporting, Cloud Atlas additionally used reverse SSH tunnels, scheduled VBS scripts to maintain those tunnels, RevSocks, and Tor-routed RDP access. The content states that Cloud Atlas encrypted dropped malware payloads with AES and RC4. Exfiltrated data was reported as RC4-encrypted ZIP archives renamed with benign multimedia extensions. Additional reporting describes a persistence and access technique in which the group patched termsrv.dll to enable multiple simultaneous RDP sessions, allowing attacker access without disconnecting the legitimate user. Known aliases in the content are Cloud Atlas, Inception, and Inception Framework. Reported associated tools and components include VBShower, PowerShower, and VBCloud.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
51 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Victims get infected via phishing emails containing a malicious document that exploits a vulnerability in the formula editor (CVE-2018-0802) to download and execute malware code.
In August 2014, some of our users observed targeted attacks with a variation of CVE-2012-0158 and an unusual set of malware.
Previously, Cloud Atlas dropped its “validator” implant named “PowerShower” directly, after exploiting the Microsoft Equation vulnerability (CVE-2017-11882) mixed with CVE-2018-0802.
Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
Observables
177 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Referenced as a threat actor associated with the MITRE ATT&CK technique T1090.003 (Multi-hop Proxy) in the detection annotation for access to anonymizer services.
Espionage-focused intrusions against government agencies and diplomatic organizations, using phishing for initial access, custom malware, modified termsrv.dll to enable concurrent RDP sessions, and layered persistence via reverse SSH tunnels, Tor, and proxy tooling.
Conducting long-running espionage-focused intrusions in 2025–2026 against organizations in Russia and Belarus, using phishing, malicious LNK archives, weaponized Office documents, PowerShell loaders, VBCloud and PowerShower backdoors, credential theft, lateral movement, and resilient access via reverse SSH tunnels, RevSocks, and Tor.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.