Octopus

MITRE ATT&CK: S0340 View on attack.mitre.org

Aliases: Octopus

First seen
2014-01-01 00:00:00
Malware type
trojan
Family
Malware family
Operating systems
windows
Related IoCs
12
Last IoC activity
2026-01-21 23:06:07
Profile updated
2026-07-07 13:07:27

Targeted industries: government-and-public-sector

Targeted regions: country_code:kz country_code:kg country_code:uz

Context

Octopus is a Windows Trojan written in the Delphi programming language that has been used by Nomadic Octopus to target government organizations in Central Asia since at least 2014.

Detection coverage

  • 387 Sigma rules

Malware & tools used

  • Data from Local System (attack-pattern)
  • System Owner/User Discovery (attack-pattern)
  • Standard Encoding (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Exfiltration to Cloud Storage (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Local Data Staging (attack-pattern)
  • Archive via Utility (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Web Protocols (attack-pattern)
  • Spearphishing Attachment (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Malicious File (attack-pattern)
  • Screen Capture (attack-pattern)

Used by threat actors

Reports & references

  • Kaspersky — 88200 (report)
  • securityaffairs.co — Russia Linked Apt Dustsquad (report)
  • virusbulletin.com — Cherepanov Vb2018 Octopus (report)
  • MITRE ATT&CK — S0340 (report)

External references