Nomadic Octopus G0133

Overview 27 indicators

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.

Techniques 7 ATT&CK

Open in ATT&CK Navigator → or download the layer (7 techniques, layer 4.5)

• T1036 Masquerading
• T1059.001 PowerShell
• T1059.003 Windows Command Shell
• T1105 Ingress Tool Transfer
• T1204.002 Malicious File
• T1564.003 Hidden Window
• T1566.001 Spearphishing Attachment

Software 1

• Octopus

Principal sources 4 reports

Ranked by how many of this actor's indicators each report brought in.

• 14prodaft.com/resource/detail/paperbug-nomadic-octopu…
• 11securelist.com/octopus-infested-seas-of-central-asia/8…
• 2twitter.com/Rmy_Reserve/status/1197448735422238721
• 2virustotal.com/gui/file/f5941f3d8dc8d60581d4915d06d56a…

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• DarkHydrus G0079
  40% of published techniques in common

Timeline 27 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2023-04-28 3 domain, 11 url3 yrs ago

   prodaft.com/resource/detail/paperbug-nomadic-octopu…

   domain	footcoinball.com
   domain	islandsnake.com
   domain	lovingearthy.com
   url	http://185.32.126.102
   url	http://185.99.133.244
   url	http://194.180.174.154
   url	http://199.188.200.245
   url	http://44.227.65.245
   url	http://44.227.76.166
   url	http://54.36.185.101
   url	http://86.106.137.150
   url	http://91.208.184.79
   url	http://91.219.238.239
   url	http://94.140.114.20

   copy batch

2. 2019-11-21 2 domain7 yrs ago

   twitter.com/Rmy_Reserve/status/1197448735422238721 · virustotal.com/gui/file/f5941f3d8dc8d60581d4915d06d56a…

   cookiesqueen.com

   poisonfight.com

   copy batch

3. 2018-10-19 10 domain, 1 url_path8 yrs ago

   securelist.com/octopus-infested-seas-of-central-asia/8…

   domain	blondehairman.com
   domain	certificatesshop.com
   domain	desperados20.es
   domain	giftfromspace.com
   domain	hovnanflovers.com
   domain	humorpics.download
   domain	latecafe.in
   domain	mikohanzer.website
   domain	porenticofacts.com
   domain	prom3.biz.ua
   url_path	/0ct0pus3.php

   copy batch

Further reading 8

• attack.mitre.org/groups/G0133
• securelist.com/octopus-infested-seas-of-central-asia/8…
• securityaffairs.co/wordpress/77165/apt/russia-linked-apt-d…
• securityweek.com/russia-linked-hackers-target-diplomatic…
• virusbulletin.com/uploads/pdf/conference_slides/2018/Cher…
• virustotal.com/gui/file/f5941f3d8dc8d60581d4915d06d56a…
• prodaft.com/resource/detail/paperbug-nomadic-octopu…
• twitter.com/Rmy_Reserve/status/1197448735422238721