Nomadic Octopus

Introduction

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants. Security Affairs DustSquad Oct 2018 Securelist Octopus Oct 2018 ESET Nomadic Octopus 2018

Activities and Tactics

Country of Origin: 🇷🇺 Russia

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1059.003 Windows Command Shell
• T1036 Masquerading
• T1566.001 Spearphishing Attachment
• T1204.002 Malicious File
• T1105 Ingress Tool Transfer
• T1564.003 Hidden Window
• T1059.001 PowerShell

ATT&CK technique IDs (denormalized)

• T1036
• T1059.001
• T1059.003
• T1105
• T1204.002
• T1564.003
• T1566.001

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• Octopus (S0340) — malware

Attribution and Evidence

Country of Origin: Russia Additional attribution information pending cataloguing.

References

[1] mitre-attack [4] ESET Nomadic Octopus 2018 Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021. [5] Securelist Octopus Oct 2018 Kaspersky Lab’s Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018. [6] SecurityWeek Nomadic Octopus Oct 2018 Kovacs, E. (2018, October 18). Russia-Linked Hackers Target Diplomatic Entities in Central Asia. Retrieved October 13, 2021. [7] Security Affairs DustSquad Oct 2018 Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.