{
	"id": "140e42d2-0909-4382-adcd-263f1bc2bc81",
	"created_at": "2026-04-06T00:09:20.676045Z",
	"updated_at": "2026-04-10T03:36:27.498832Z",
	"deleted_at": null,
	"sha1_hash": "6fb7b8f5000389fe4e0291a678586aad2b84e36b",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 44659,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\r\nArchived: 2026-04-05 15:26:16 UTC\r\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Lastacloud\r\n Tool: Lastacloud\r\nNames Lastacloud\r\nCategory Malware\r\nType Dropper, Backdoor\r\nDescription\r\n(Symantec) Inception has an ongoing interest in mobile devices and has previously developed\r\nmalware to infect Android (Android.Lastacloud), iOS (IOS.Lastaccoud) and BlackBerry\r\ndevices (BBOS.Lastacloud).\r\nMobile malware continues to be deployed and the group has made some modifications to its\r\nAndroid malware. The malware is spread via SMS messages and emails containing malicious\r\nlinks. Once installed, it uses user profile pages on online forums as dead drops for its C\u0026C.\r\nInformation\r\n\u003chttps://symantec-blogs.broadcom.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies\u003e\r\nLast change to this tool card: 20 April 2020\r\nDownload this tool card in JSON format\r\nAll groups using tool Lastacloud\r\nChanged Name Country Observed\r\nAPT groups\r\n  Inception Framework, Cloud Atlas 2012-2024  \r\n1 group listed (1 APT, 0 other, 0 unknown)\r\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6e565b35-d5a9-4a46-91cc-42af86a7c479\r\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6e565b35-d5a9-4a46-91cc-42af86a7c479\r\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=6e565b35-d5a9-4a46-91cc-42af86a7c479"
	],
	"report_names": [
		"listgroups.cgi?u=6e565b35-d5a9-4a46-91cc-42af86a7c479"
	],
	"threat_actors": [
		{
			"id": "77b28afd-8187-4917-a453-1d5a279cb5e4",
			"created_at": "2022-10-25T15:50:23.768278Z",
			"updated_at": "2026-04-10T02:00:05.266635Z",
			"deleted_at": null,
			"main_name": "Inception",
			"aliases": [
				"Inception Framework",
				"Cloud Atlas"
			],
			"source_name": "MITRE:Inception",
			"tools": [
				"PowerShower",
				"VBShower",
				"LaZagne"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "04a7ebaa-ebb1-4971-b513-a0c86886d932",
			"created_at": "2023-01-06T13:46:38.784965Z",
			"updated_at": "2026-04-10T02:00:03.099088Z",
			"deleted_at": null,
			"main_name": "Inception Framework",
			"aliases": [
				"Clean Ursa",
				"Cloud Atlas",
				"G0100",
				"ATK116",
				"Blue Odin"
			],
			"source_name": "MISPGALAXY:Inception Framework",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "02c9f3f6-5d10-456b-9e63-750286048149",
			"created_at": "2022-10-25T16:07:23.722884Z",
			"updated_at": "2026-04-10T02:00:04.72726Z",
			"deleted_at": null,
			"main_name": "Inception Framework",
			"aliases": [
				"ATK 116",
				"Blue Odin",
				"Clean Ursa",
				"Cloud Atlas",
				"G0100",
				"Inception Framework",
				"Operation Cloud Atlas",
				"Operation RedOctober",
				"The Rocra"
			],
			"source_name": "ETDA:Inception Framework",
			"tools": [
				"Lastacloud",
				"PowerShower",
				"VBShower"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434160,
	"ts_updated_at": 1775792187,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/6fb7b8f5000389fe4e0291a678586aad2b84e36b.pdf",
		"text": "https://archive.orkl.eu/6fb7b8f5000389fe4e0291a678586aad2b84e36b.txt",
		"img": "https://archive.orkl.eu/6fb7b8f5000389fe4e0291a678586aad2b84e36b.jpg"
	}
}