Inception G0100

Overview 239 indicators

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.

Techniques 22 ATT&CK

Open in ATT&CK Navigator → or download the layer (22 techniques, layer 4.5)

• T1005 Data from Local System
• T1027.013 Encrypted/Encoded File
• T1057 Process Discovery
• T1059.001 PowerShell
• T1059.005 Visual Basic
• T1069.002 Domain Groups
• T1071.001 Web Protocols
• T1082 System Information Discovery
• T1083 File and Directory Discovery
• T1090.003 Multi-hop Proxy
• T1102 Web Service
• T1203 Exploitation for Client Execution
• T1204.002 Malicious File
• T1218.005 Mshta
• T1218.010 Regsvr32
• T1221 Template Injection
• T1518 Software Discovery
• T1547.001 Registry Run Keys / Startup Folder
• T1555.003 Credentials from Web Browsers
• T1566.001 Spearphishing Attachment
• T1573.001 Symmetric Cryptography
• T1588.002 Tool

Software 3

• LaZagne
• PowerShower
• VBShower

Principal sources 127 reports

Ranked by how many of this actor's indicators each report brought in.

• 40x.com/askardyuss/status/2066210696929452163
• 40virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d…
• 40virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…
• 35twitter.com/ShadowChasing1/status/13917886703492874…
• 35domaintools.com/resources/blog/current-events-to-widesp…
• 35otx.alienvault.com/pulse/5fb8172cdb6535bd6935bfd6
• 35virustotal.com/gui/file/e5b76a3ec4c9b0a42ec953022b5d64…
• 30securelist.com/cloud-atlas-h1-2025-campaign/118517

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• Gamaredon Group G0047
  1 shared indicator

Timeline 239 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-08-05 14 domainthis year

   twitter.com/felixaime/status/1601257303080308739 · twitter.com/felixaime/status/1601257305294921728

   wall-audit.com

   wall-comply.com

   wall-consult.com

   wall-cyber.com

   wall-defend.com

   wall-hq.com

   wall-ops.com

   wall-pentest.com

   wall-redteam.com

   wall-secure.com

   wall-team.com

   wallpaperex.com

   web-digest.ru

   webwaxhaw.com

   copy batch

2. 2026-06-16 32 domain, 2 ipv4this year

   x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

   domain	3i.hilsabecks.net
   domain	56.msgntfsys.link
   domain	7h.ahmetgurses.net
   domain	ahmetgurses.net
   domain	aitoall.ru
   domain	arendelle.ru
   domain	bot.fortune-wheel.ru
   domain	bryksina.ru
   domain	dezinsekciya-top.ru
   domain	elycleu.click
   domain	fcauditsp.ru
   domain	fortune-wheel.ru
   domain	ftp.arendelle.ru
   domain	ftp.bryksina.ru
   domain	ftp.dezinsekciya-top.ru
   domain	ftp.wolrpg.ru
   domain	ftp.zhk-ambassador.ru
   domain	hilsabecks.net
   domain	kjzxpe.ru
   domain	mail.aitoall.ru
   domain	mail.arendelle.ru
   domain	mail.bryksina.ru
   domain	mail.dezinsekciya-top.ru
   domain	mail.msgntfsys.link
   domain	mail.wolrpg.ru
   domain	mail.zhk-ambassador.ru
   domain	msgntfsys.link
   domain	mvecak.ru
   domain	refunmvd.sa.com
   domain	wolrpg.ru
   domain	yarcoff.ru
   domain	zhk-ambassador.ru
   ipv4	194.190.153.182:443
   ipv4	94.232.248.34:443

   copy batch

3. 2026-02-14 1 urlthis year

   x.com/t3ft3lb/status/2022249576405864776 · virustotal.com/gui/file/46e0f6fd0f25b1c52b4e27979c923f…

   internationalcommoditiesllc.com/ic/

   copy batch

4. 2026-01-08 29 domainthis year

   securelist.com/cloud-atlas-h1-2025-campaign/118517 · virustotal.com/gui/ip-address/185.143.221.7/relations · virustotal.com/gui/ip-address/45.151.62.98/relations · virustotal.com/gui/ip-address/95.215.108.187/relations

   apkcrypter.com

   billet-ru.net

   cityru-travel.org

   connectcosmo.click

   connectcosmo.online

   copilotgptawer.cfd

   cosmo-service.org

   flashsupport.org

   hostscontrol.com

   ieobil.asia

   information-model.net

   iznews.net

   marketru.net

   mcdrugs.com

   medoaaustinsci.info

   micron-media.com

   mskreg.net

   mta1.medoaaustinsci.info

   multipackage.net

   roskomnadz.com

   rostvgroup.com

   russiatimes.info

   rzhd.org

   securemodem.com

   servantcafe.com

   solid-logit.com

   telehraf.com

   transferpolicy.org

   vds1.clinicsearchcasestudies.com

   copy batch

5. 2026-01-08 1 domainthis year

   x.com/t3ft3lb/status/1938697172012470308 · app.any.run/tasks/f95a54b2-8a63-42f9-945e-80cb34d11… · virustotal.com/gui/file/b7ea9d1c42d4f5802ae473be09b034… · virustotal.com/gui/file/0b5b54f8cf6b994eeba9610c62c7fe… · securelist.com/cloud-atlas-h1-2025-campaign/118517 · virustotal.com/gui/ip-address/185.143.221.7/relations · virustotal.com/gui/ip-address/45.151.62.98/relations · virustotal.com/gui/ip-address/95.215.108.187/relations

   gimnazija.org

   copy batch

6. 2026-01-02 or earlier 1 url_paththis year

   x.com/t3ft3lb/status/1938697172012470308 · app.any.run/tasks/f95a54b2-8a63-42f9-945e-80cb34d11… · virustotal.com/gui/file/b7ea9d1c42d4f5802ae473be09b034… · virustotal.com/gui/file/0b5b54f8cf6b994eeba9610c62c7fe…

   /dmvc.html/bopyrus40

   copy batch

7. 2026-01-02 or earlier 1 domainthis year

   x.com/IdaNotPro/status/1937198405924667778 · virustotal.com/gui/file/e6448e92bc3cc8706a9429d93ea32b…

   nedvij-gel.ru

   copy batch

8. 2025-01-21 2 domain1 yr ago

   x.com/Des00464472/status/1881598731986034794 · virustotal.com/gui/file/f583523bba0a3c27e08ebb4404d749… · virustotal.com/gui/file/2b2da38b62916c448235038f09c51f…

   fmsru.ru

   nefteparkstroy.ru

   copy batch

9. 2024-12-25 15 domain2 yrs ago

   x.com/BaoshengbinCumt/status/1871828767569789… · securelist.com/cloud-atlas-attacks-with-new-backdoor-v…

   content-protect.net

   control-issue.net

   gosportal.net

   mirconnect.info

   net-plugin.org

   office-confirm.com

   onesoftware.info

   riamir.net

   sber-cloud.info

   serverop-parametrs.com

   web-privacy.net

   web-wathapp.com

   yandesks.net

   yandesktop.com

   yandisk.info

   copy batch

10. 2024-12-25 1 domain2 yrs ago

    virustotal.com/gui/file/b35bfe34db55545612322970b6bf77… · virustotal.com/gui/file/268dfc61a97ec6af3655405b939d50…

    mehafon.com

    copy batch

11. 2024-02-20 2 domain2 yrs ago

    twitter.com/t3ft3lb/status/1759849432936272143 · virustotal.com/gui/ip-address/146.19.143.25/relations · virustotal.com/gui/ip-address/192.254.79.69/relations · app.any.run/tasks/094820ce-042b-435f-9ce2-2d65c539d… · virustotal.com/gui/file/5af1214fc0ca056e266b2d093099a3… · virustotal.com/gui/file/97c1b67ca33790ff7656496b7511a8… · virustotal.com/gui/file/b4c0902a9fb29993bc7573d6e84547… · virustotal.com/gui/file/d54b1ddb6f3bc94d68e9eddebf0caf…

    triger-working.com

    web-telegrama.org

    copy batch

12. 2023-12-20 1 domain3 yrs ago

    community.emergingthreats.net/t/ruleset-update-summary-2023-12-19-v10…

    avito-service.net

    copy batch

13. 2023-10-26 1 domain3 yrs ago

    twitter.com/t3ft3lb/status/1717545342294528309 · virustotal.com/gui/ip-address/95.217.82.125/relations · virustotal.com/gui/file/e3d2e6f8740bc5a510239af41e77a3…

    network-list.com

    copy batch

14. 2023-09-26 1 domain3 yrs ago

    twitter.com/suyog41/status/1706618278066434180 · virustotal.com/gui/ip-address/188.120.249.17/relations · virustotal.com/gui/file/fbb6d99412b83621dc8f5293d42ebc… · virustotal.com/gui/file/e3be669caa13562d293c4523251319… · virustotal.com/gui/file/d2b621ee0bda40eaa43f55e697d79c… · virustotal.com/gui/file/4b47793851c3844e5344e703618a3a… · virustotal.com/gui/file/2600c984ac0571a72882cf12de449c…

    softcillection.com

    copy batch

15. 2023-07-16 2 ipv43 yrs ago

    twitter.com/FF1565166422/status/1645252984643932160 · twitter.com/StopMalvertisin/status/1676260222573375… · virustotal.com/gui/file/ae2a3b4bc5c1c5b7419c9daa3e32e8… · virustotal.com/gui/file/a9279ccd0bfc953a8acc4b13423590…

    185.252.147.12:5612

    185.252.147.12:5800

    copy batch

16. 2023-06-26 1 domain3 yrs ago

    twitter.com/suyog41/status/1673215056287285249 · virustotal.com/gui/file/708c2eb5a979cbfa8e240679282a37…

    msk-gov.com

    copy batch

17. 2023-06-05 2 domain3 yrs ago

    twitter.com/t3ft3lb/status/1665686960764067840 · virustotal.com/gui/file/a4ab42ae16cc044ecd5c0bd91cc13b…

    managements.wireless-log.net

    wireless-log.net

    copy batch

18. 2023-05-24 1 domain3 yrs ago

    twitter.com/suyog41/status/1661254437216583683 · virustotal.com/gui/file/e49b6200b408e1fc2c3886805d4a1b…

    yandexbraveupdateinfo.net

    copy batch

19. 2023-04-26 1 domain, 1 url_path3 yrs ago

    twitter.com/t3ft3lb/status/1651154256294977537 · virustotal.com/gui/file/95cc7af0dbb0b927ab369621d62e87…

    domain	host-tools.net
    url_path	/?zboard_zboard.php?id=

    copy batch

20. 2023-04-18 2 domain, 1 ipv43 yrs ago

    twitter.com/StopMalvertisin/status/1648213776112717… · twitter.com/StopMalvertisin/status/1648213782957809… · twitter.com/RexorVc0/status/1651201212480466945 · mp-weixin-qq-com.translate.goog/s/bOJ88Zzk27ZaHShlYUCYgA?_x_tr_sl=auto&… · virustotal.com/gui/file/4aac08bbead6b3e3695f588e2c6d9e… · virustotal.com/gui/file/1d03a3cd25fb95bc52f557df311002… · virustotal.com/gui/file/d1d602cd4aacef412d97640f3a0305…

    domain	http-updater.hs.vc
    domain	teexgjvvhuab.webhop.me
    ipv4	5.252.179.45:55000

    copy batch

21. 2023-04-14 2 domain3 yrs ago

    community.emergingthreats.net/t/ruleset-update-summary-2023-04-13-v10… · virustotal.com/gui/file/dc1a0b4aa62729ec12c52ccdfb6011… · virustotal.com/gui/file/82f76dca581ccddac695170b0c9d4e…

    agent-group.org

    supportpanel.agent-group.org

    copy batch

22. 2023-04-10 1 domain, 1 ipv43 yrs ago

    twitter.com/FF1565166422/status/1645252984643932160 · twitter.com/StopMalvertisin/status/1676260222573375… · virustotal.com/gui/file/ae2a3b4bc5c1c5b7419c9daa3e32e8… · virustotal.com/gui/file/a9279ccd0bfc953a8acc4b13423590…

    domain	infovesty.ru
    ipv4	185.252.147.12:443

    copy batch

23. 2023-02-22 1 domain3 yrs ago

    twitter.com/kyleehmke/status/1628419317103460359 · virustotal.com/gui/ip-address/5.101.66.135/relations

    windows-srv.com

    copy batch

24. 2023-01-26 1 domain3 yrs ago

    twitter.com/k3yp0d/status/1618541802675646464 · virustotal.com/gui/file/283348e93ef616a130f3bdf313499c…

    becloud.website

    copy batch

25. 2023-01-26 1 domain3 yrs ago

    twitter.com/k3yp0d/status/1618539713228574721 · virustotal.com/gui/file/ddeb109a97e3689b63d4ee848d4c23…

    e-aks.uz

    copy batch

26. 2023-01-25 2 domain3 yrs ago

    twitter.com/h2jazi/status/1618347920792907777 · virustotal.com/gui/file/176b336f425bc15651672f96f70149… · virustotal.com/gui/file/6501dd570761f2bd3eff4e3416baef… · virustotal.com/gui/file/9f8d3ee51af949ae15ca18c6fdd8e6…

    archive-downloader.com

    cloud.archive-downloader.com

    copy batch

27. 2023-01-13 1 domain3 yrs ago

    twitter.com/RedDrip7/status/1613806512211910657 · twitter.com/RedDrip7/status/1613806655418028034 · virustotal.com/gui/file/36cbd8eb24aa60809e67c85f17151b… · virustotal.com/gui/file/141b2c01f4fb9326fc60690cf7d36a…

    exactsynchtime.ru

    copy batch

28. 2022-12-21 1 domain4 yrs ago

    twitter.com/RedDrip7/status/1613806512211910657 · twitter.com/RedDrip7/status/1613806655418028034 · virustotal.com/gui/file/36cbd8eb24aa60809e67c85f17151b… · virustotal.com/gui/file/141b2c01f4fb9326fc60690cf7d36a…

    cortanaupdater.info

    copy batch

29. 2022-12-09 9 domain4 yrs ago

    ptsecurity.com/ww-en/analytics/pt-esc-threat-intellige…

    api-help.com

    comparelicense.com

    driver-updated.com

    mynewtemplate.com

    new-template.com

    sync-firewall.com

    system-logs.com

    technology-requests.net

    translate-news.net

    copy batch

30. 2022-12-09 5 domain4 yrs ago

    twitter.com/felixaime/status/1601257303080308739 · twitter.com/felixaime/status/1601257305294921728

    driver-key.com

    microsoftsample.com

    reload-config.com

    safety-key.org

    web-digest.com

    copy batch

31. 2022-12-09 4 domain4 yrs ago

    research.checkpoint.com/2022/cloud-atlas-targets-entities-in-ru…

    desktoppreview.com

    driversolution.net

    gettemplate.org

    support-app.net

    copy batch

32. 2022-11-25 1 domain, 2 url_path4 yrs ago

    twitter.com/h2jazi/status/1595787712996556800 · virustotal.com/gui/file/186289754f499c26aa66f9305f792a…

    domain	remote-convert.com
    url_path	/Access/acrydium/
    url_path	/Access/acrydium/osteectomies

    copy batch

33. 2022-11-14 1 domain, 2 url_path4 yrs ago

    twitter.com/h2jazi/status/1592158351475240962 · virustotal.com/gui/file/b1a2eb532c461ff2faa4ec9edf44d2… · virustotal.com/gui/file/8217e38b3dba43d88b397aa0de945e… · virustotal.com/gui/file/1b3a85d596d65e0101eeddd539cec5… · virustotal.com/gui/file/12f9dcdfea0520436e8c5749fbefed…

    domain	protocol-list.com
    url_path	/shab/haftarot/
    url_path	/shab/haftarot/s

    copy batch

34. 2022-05-24 5 domain, 1 ipv44 yrs ago

    blog.malwarebytes.com/malwarebytes-news/2022/05/unknown-apt-g… · virustotal.com/gui/ip-address/192.153.57.83/relations · virustotal.com/gui/ip-address/91.210.104.54/relations · virustotal.com/gui/file/12c20f9dbdb8955f3f88e28dc10241… · virustotal.com/gui/file/cbde42990e53f5af37e6f6a9fd1471… · virustotal.com/gui/file/ca95e8a8b6fb11b5129821f034b337…

    domain	fatobara.com
    domain	microsftupdetes.com
    domain	mirror-exchange.com
    domain	rostec.digital
    domain	windowsipdate.com
    ipv4	168.100.11.142:443

    copy batch

35. 2021-12-14 24 domain5 yrs ago

    zscaler.com/blogs/security-research/cloudfall-targe… · virustotal.com/gui/file/d911e17b3628471713adeac2c86ad4…

    advancestore.workers.dev

    api.office365online.workers.dev

    asia.office365-cloud.workers.dev

    cloud.digitalstorage.workers.dev

    curly-waterfall-360d.fetrikekke531.workers.dev

    dc-microsoft.workers.dev

    digitalstorage.workers.dev

    documents.publicserver.workers.dev

    eu.microsoft-365.workers.dev

    falling-haze-1812.jerkufetra754.workers.dev

    falling-haze-1813.jerkufetra754.workers.dev

    fetrikekke531.workers.dev

    jerkufetra754.workers.dev

    microsoft-365.workers.dev

    microsoft-cloud.workers.dev

    mirror.advancestore.workers.dev

    office365-cloud.workers.dev

    office365.dc-microsoft.workers.dev

    office365.microsoft-cloud.workers.dev

    office365online.workers.dev

    plug.repository.workers.dev

    publicserver.workers.dev

    repository.workers.dev

    virustotall-360d.fetrikekke531.workers.dev

    copy batch

36. 2021-12-10 1 domain5 yrs ago

    twitter.com/ShadowChasing1/status/14691457957230714… · twitter.com/ShadowChasing1/status/14689245656531599… · virustotal.com/gui/ip-address/185.117.91.175/relations · virustotal.com/gui/file/309ba0a33ecf3e123bc3e539a5443b… · virustotal.com/gui/file/60e9222f464cc99014a909ca4548cf…

    msdocumentviever.com

    copy batch

37. 2021-11-20 1 domain5 yrs ago

    twitter.com/h2jazi/status/1453748348964548617 · virustotal.com/gui/file/9e23a08981ae336068905c771754f7…

    checklicensekey.com

    copy batch

38. 2021-05-11 1 url_path5 yrs ago

    x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

    /azure6steeps4sneaker2wow5herpes0him6fawn9octree5

    copy batch

39. 2021-03-02 1 domain5 yrs ago

    twitter.com/kyleehmke/status/1366796835541684224

    ms-officeupdate.org

    copy batch

40. 2021-02-25 1 url_path5 yrs ago

    x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

    /soarnegroidmeanalkydapresowntipslushing.png

    copy batch

41. 2021-02-25 1 url5 yrs ago

    domaintools.com/resources/blog/the-continuous-conundrum…

    http://185.70.184.32/soarnegroidmeanalkydapresowntipslushing.png

    copy batch

42. 2021-02-24 1 url_path5 yrs ago

    twitter.com/ShadowChasing1/status/13644363308941352… · virustotal.com/gui/file/4011b1fff8c088fcb4ac4a05a5a156… · x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

    /validate7condom7rapids9simoom9

    copy batch

43. 2021-02-24 1 url_path5 yrs ago

    twitter.com/ShadowChasing1/status/13644353826836684… · virustotal.com/gui/file/439032cbee22ae75cce7e2340ca7ff…

    /referential5refugee0douglas4modulate5trio7

    copy batch

44. 2021-02-22 1 url_path5 yrs ago

    x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

    /appalcanedentrecentlyconvergenting.png

    copy batch

45. 2021-02-22 1 url5 yrs ago

    twitter.com/h2jazi/status/1363918659534659587 · virustotal.com/gui/file/668236000a483b1735b7f8e244ae86… · domaintools.com/resources/blog/the-continuous-conundrum…

    http://139.60.161.74/appalcanedentrecentlyconvergenting.png

    copy batch

46. 2021-02-22 1 url5 yrs ago

    twitter.com/h2jazi/status/1363918659534659587 · virustotal.com/gui/file/668236000a483b1735b7f8e244ae86…

    http://217.182.9.185/appalcanedentrecentlyconvergenting.png

    copy batch

47. 2021-02-20 2 domain5 yrs ago

    twitter.com/jfslowik/status/1363255047929294853

    eurasia-research.org

    ms-template.com

    copy batch

48. 2021-02-19 1 url_path5 yrs ago

    x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

    /veal3reveal0bask6goodby9gust6legitimate6wiliness1

    copy batch

49. 2021-02-18 1 url_path5 yrs ago

    x.com/askardyuss/status/2066210696929452163 · virustotal.com/gui/file/1402053d6edb096b59b8df3b81d56d… · virustotal.com/gui/file/4661735db0f33dd567d29b2a056a96…

    /politic8stylist1stultification8sadomasochism2

    copy batch

50. 2021-02-10 1 domain5 yrs ago

    twitter.com/kyleehmke/status/1359531943252140040 · twitter.com/ShadowChasing1/status/13623592200461926… · virustotal.com/gui/file/46c203cf15a4126f10b39333762150…

    ms-update.org

    copy batch

51. 2020-12-20 1 domain6 yrs ago

    twitter.com/jfslowik/status/1340352860274393088 · twitter.com/ShadowChasing1/status/13591270274381127… · virustotal.com/gui/file/21ff553d752df93e10e45d0393eb09…

    ms-officeupdate.com

    copy batch

52. 2020-11-21 32 domain6 yrs ago

    twitter.com/ShadowChasing1/status/13917886703492874… · domaintools.com/resources/blog/current-events-to-widesp… · otx.alienvault.com/pulse/5fb8172cdb6535bd6935bfd6 · virustotal.com/gui/file/e5b76a3ec4c9b0a42ec953022b5d64…

    2020-windows.com

    azureblog.info

    brexitimpact.com

    doc-fid.com

    e-government-pk.com

    e-govoffice.com

    get-news-online.com

    gmocloudhosting.com

    interior-gov.com

    iphoneupdatecheck.com

    live-media.org

    liveinfo.org

    log1inbox.com

    ms-check-new-update.com

    msofficeupdate.org

    msupdatecheck.com

    netserviceupdater.com

    newoffice-update.com

    newupdate.org

    officeupgrade.org

    petronas-me.com

    rarnbler.com

    rneil.ru

    srv3-serveup-ads.net

    template-new.com

    template-office.org

    tls-login.com

    update-office.com

    upgrade-office.com

    upgrade-office.org

    user-twitter.com

    weather-server.net

    copy batch

53. 2020-11-18 2 domain6 yrs ago

    twitter.com/ShadowChasing1/status/13917886703492874… · domaintools.com/resources/blog/current-events-to-widesp… · otx.alienvault.com/pulse/5fb8172cdb6535bd6935bfd6 · virustotal.com/gui/file/e5b76a3ec4c9b0a42ec953022b5d64…

    msofficeupdate.com

    new-office.org

    copy batch

54. 2019-11-21 1 domain7 yrs ago

    twitter.com/Vishnyak0v/status/1197402642651193345 · twitter.com/ShadowChasing1/status/13917886703492874… · domaintools.com/resources/blog/current-events-to-widesp… · otx.alienvault.com/pulse/5fb8172cdb6535bd6935bfd6 · virustotal.com/gui/file/e5b76a3ec4c9b0a42ec953022b5d64…

    newoffice-template.com

    copy batch

55. 2019-08-12 2 url7 yrs ago

    securelist.com/recent-cloud-atlas-activity/92016 · otx.alienvault.com/pulse/5d5176f09f3f84634e1f0227

    http://144.217.174.57

    http://176.31.59.232

    copy batch

56. 2019-08-12 1 url7 yrs ago

    securelist.com/cloud-atlas-redoctober-apt-is-back-in-s…

    webdav.cloudme.com/bimm4276/CloudDrive/

    copy batch

57. 2016-03-08 4 domain10 yrs ago

    bluecoat.com/documents/download/638d602b-70f4-4644-a…

    blackberry-support.herokuapp.com

    ecolines.es

    haarmannsi.cz

    sanygroup.co.uk

    copy batch

Further reading 130

• attack.mitre.org/groups/G0100
• securelist.com/cloud-atlas-redoctober-apt-is-back-in-s…
• symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-fra…
• unit42.paloaltonetworks.com/unit42-inception-attackers-target-europ…
• twitter.com/h2jazi/status/1592158351475240962
• blog.malwarebytes.com/malwarebytes-news/2022/05/unknown-apt-g…
• virustotal.com/gui/file/60e9222f464cc99014a909ca4548cf…
• virustotal.com/gui/file/176b336f425bc15651672f96f70149…
• twitter.com/FF1565166422/status/1645252984643932160
• twitter.com/jfslowik/status/1340352860274393088
• virustotal.com/gui/ip-address/192.254.79.69/relations
• twitter.com/felixaime/status/1601257305294921728
• twitter.com/jfslowik/status/1363255047929294853
• virustotal.com/gui/file/309ba0a33ecf3e123bc3e539a5443b…
• virustotal.com/gui/file/21ff553d752df93e10e45d0393eb09…
• virustotal.com/gui/file/141b2c01f4fb9326fc60690cf7d36a…
• virustotal.com/gui/file/97c1b67ca33790ff7656496b7511a8…
• virustotal.com/gui/file/b4c0902a9fb29993bc7573d6e84547…
• twitter.com/h2jazi/status/1363918659534659587
• twitter.com/RedDrip7/status/1613806512211910657
• bluecoat.com/documents/download/638d602b-70f4-4644-a…
• virustotal.com/gui/file/1b3a85d596d65e0101eeddd539cec5…
• virustotal.com/gui/file/e49b6200b408e1fc2c3886805d4a1b…
• twitter.com/ShadowChasing1/status/13591270274381127…
• x.com/askardyuss/status/2066210696929452163
• virustotal.com/gui/file/ddeb109a97e3689b63d4ee848d4c23…
• twitter.com/Vishnyak0v/status/1197402642651193345
• x.com/t3ft3lb/status/2022249576405864776
• domaintools.com/resources/blog/the-continuous-conundrum…
• virustotal.com/gui/ip-address/192.153.57.83/relations
• twitter.com/StopMalvertisin/status/1648213776112717…
• virustotal.com/gui/file/d1d602cd4aacef412d97640f3a0305…
• virustotal.com/gui/file/82f76dca581ccddac695170b0c9d4e…
• twitter.com/suyog41/status/1673215056287285249
• twitter.com/RedDrip7/status/1613806655418028034
• twitter.com/h2jazi/status/1595787712996556800
• virustotal.com/gui/file/2b2da38b62916c448235038f09c51f…
• virustotal.com/gui/file/36cbd8eb24aa60809e67c85f17151b…
• virustotal.com/gui/file/439032cbee22ae75cce7e2340ca7ff…
• virustotal.com/gui/file/e5b76a3ec4c9b0a42ec953022b5d64…

90 more, and the report behind every indicator, in G0100.json.