Threat Actor 🇷🇺 Russia

Inception Framework

Also known as: Clean Ursa · Cloud Atlas · OXYGEN · G0100 · ATK116 · Blue Odin

This threat actor uses spear-phishing techniques to target private-sector energy, defense, aerospace, research, and media organizations and embassies in Africa, Europe, and the Middle East, for the purpose of espionage.

Indicators of Compromise 3

Domain proton66[.]ooo GitHub User pepegit666 IP 91[.]211[.]244[.]119

MITRE ATT&CK TTPs 13

T1003.002
Security Account Manager
Credential Access
 T1021.002
SMB/Windows Admin Shares
Lateral Movement
 T1055
Process Injection
Defense Evasion
 T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078
Valid Accounts
Defense Evasion
 T1085
T1085
 T1133
External Remote Services
Persistence
 T1204.002
Malicious File
Execution
 T1212
Exploitation for Credential Access
Credential Access
 T1485
Data Destruction
Impact
 T1558
Steal or Forge Kerberos Tickets
Credential Access
 T1566
Phishing
Initial Access

Source Articles

ThreatsDay: Game Cheat Spyware, 24-Hour Ransomware, Chrome Sync Stalking + 12 More Stories
Multiple cyber threat campaigns were observed in mid-2026, including malicious NuGet packages distributing spyware disguised as game cheats, fake installers delivering the Starland RAT and WLDR C2 implant, and a new ransomware family named Spirals that encrypted a South Asian IT firm's network within 24 hours. Threat actors exploited known vulnerabilities such as CVE-2026-46817 and CVE-2023-4346, while also leveraging social engineering via phishing eCards and OAuth device code attacks. Additional threats include large-scale infostealer distribution through fake GitHub repositories, Chrome Sync abuse for stalking, and dual monetization campaigns deploying Vidar stealer and XMRig miner.
hacker-news ·1w ago