LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0340: Octopus

Octopus is a Windows Trojan written in the Delphi programming language that has been used by Nomadic Octopus to target government organizations in Central Asia since at least 2014.[1][2][3]

EnterpriseS0340MalwareObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Octopus matters because it is a Windows Trojan associated in ATT&CK with espionage-focused activity against government-related targets in Central Asia. For leaders, the practical issue is not the malware name alone, but the behavior pattern: user-driven malicious-file execution, persistence through Run keys or startup locations, host and user discovery, local collection and staging, screen capture, and exfiltration over web/C2 or cloud-storage channels. That combination can turn one opened attachment into a confidentiality and diplomatic/business-continuity incident if endpoint, email, identity, and egress evidence is incomplete.

Executive priority

Prioritize this as a validation case for Windows endpoint resilience, phishing response readiness, and data-loss visibility. Ask whether the organization can prove when a user opened a suspicious attachment, whether persistence was created, what local data was enumerated or staged, and whether outbound web or cloud-storage traffic carried unusual encoded or archived content. The ATT&CK object has no official detection guidance, so assurance should come from local control testing and incident-response evidence, not from assuming named-malware coverage.

Technical view

ATT&CK lists Octopus as Windows malware used by Nomadic Octopus and relates it to techniques spanning initial access/execution, persistence, discovery, collection, command and control, and exfiltration. SOC and IR teams should validate telemetry for malicious attachments and child-process execution, Registry Run key/startup folder changes, WMI execution, user/system/network/storage/file discovery, local staging and archive creation, screenshot activity, ingress tool transfer, encoded web-based C2, exfiltration over C2, and exfiltration to cloud storage. Detection engineering should build behavior-led coverage rather than relying only on static indicators, especially because the official object does not provide detection text.

Likely telemetry

  • Email security and mail gateway records for spearphishing attachments and user delivery/open events
  • Windows endpoint process creation, parent-child process chains, command-line, and file-write telemetry
  • Registry monitoring for Run keys and startup folder persistence
  • WMI activity logs and endpoint management telemetry
  • File and directory enumeration, archive creation, local staging paths, and access to sensitive local files

Detection direction

  • Start with ATT&CK relationships: correlate malicious-file execution with subsequent persistence, discovery, staging, archive, and outbound web/cloud activity on the same Windows host.
  • Tune for suspicious Registry Run key/startup folder creation, especially when the referenced binary name or location resembles legitimate resources.
  • Review WMI execution for unusual users, hosts, parent processes, or commands; account for legitimate administration tools to reduce false positives.
  • Hunt for sequences of host discovery followed by file discovery, local staging, archive creation, and outbound transfer rather than treating each event as high confidence alone.
  • Use egress analytics for uncommon destinations, unusual upload volumes, encoded payload patterns, or cloud-storage use inconsistent with the user or host baseline.

Mitigation priorities

  • Reduce initial access risk with attachment controls, user-reporting workflows, and rapid phishing triage for targeted malicious files.
  • Harden Windows persistence surfaces by monitoring and controlling Registry Run keys and startup folders, with change accountability.
  • Limit unnecessary WMI use and ensure administrative activity is logged, attributable, and reviewed.
  • Apply least privilege and data-access controls so a compromised user context exposes less local sensitive data.
  • Control outbound web and cloud-storage access according to business need, with logging sufficient for investigation of uploads and C2-like traffic.
Additional notes and limits

The most useful defensive framing is behavior-chain validation: attachment execution leading to persistence, discovery, collection/staging, and outbound transfer. The relationship to Nomadic Octopus provides threat-intelligence context, including Central Asia government and diplomatic targeting, but local prioritization should be based on the organization’s geography, sector, Windows exposure, email threat model, and data sensitivity.

This take uses only the supplied ATT&CK fields and relationships. The Octopus object lists Windows as the platform but does not specify tactics or official detection guidance. External source details were not expanded beyond the supplied references. No claim is made that Octopus is currently active, present in any environment, or detectable by any specific product.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Octopus

Octopus is a Windows Trojan written in the Delphi programming language that has been used by Nomadic Octopus to target government organizations in Central Asia since at least 2014.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

19 rows
DomainIDNameRelationship / procedure
EnterpriseT1005Data from Local System

Octopus can exfiltrate files from the system using a documents collector tool.[3]

EnterpriseT1033System Owner/User Discovery

Octopus can collect the username from the victim’s machine.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Octopus has encoded C2 communications in Base64.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.[1][3]

EnterpriseT1016System Network Configuration Discovery

Octopus can collect the host IP address from the victim’s machine.[1]

EnterpriseT1083File and Directory Discovery

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.[1][2][3]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

Octopus has exfiltrated data to file sharing sites.[3]

EnterpriseT1082System Information Discovery

Octopus can collect the computer name, OS version, and OS architecture information.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Octopus has stored collected information in the Application Data directory on a compromised host.[1][3]

EnterpriseT1560.001Archive via UtilitySub-technique

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.[3]

EnterpriseT1047Windows Management Instrumentation

Octopus has used wmic.exe for local discovery information.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Octopus has used HTTP GET and POST requests for C2 communications.[1][3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Octopus has been delivered via spearsphishing emails.[3]

EnterpriseT1105Ingress Tool Transfer

Octopus can download additional files and tools onto the victim’s machine.[1][2][3]

EnterpriseT1680Local Storage Discovery

Octopus can collect system drive and disk size information.[1]

EnterpriseT1204.002Malicious FileSub-technique

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.[3]

EnterpriseT1113Screen Capture

Octopus can capture screenshots of the victims’ machine.[1][2][3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0133: Nomadic Octopus

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · GroupG0133: Nomadic OctopusEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1113: Screen CaptureEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.1
Created
Modified
Raw hash
468c6511b7f6f09f...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.1Current bundle468c6511b7f6…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  2. [2]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  3. [3]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  4. [4]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  5. [5]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  6. [6]
    Octopus

    (Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)

  7. [7]
    Octopus

    (Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)

  8. [8]
    Octopus

    (Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)

  9. [9]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  10. [10]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  11. [11]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  12. [12]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  13. [13]
    mitre-attackS0340
    Open source URL
  14. [14]
    mitre-attackS0340
    Open source URL
  15. [15]
    mitre-attackS0340
    Open source URL
  16. [16]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  17. [17]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  18. [18]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  19. [19]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  20. [20]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  21. [21]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  22. [22]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  23. [23]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  24. [24]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  25. [25]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  26. [26]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  27. [27]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  28. [28]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  29. [29]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  30. [30]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  31. [31]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  32. [32]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  33. [33]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  34. [34]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  35. [35]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  36. [36]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  37. [37]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  38. [38]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  39. [39]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  40. [40]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  41. [41]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  42. [42]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  43. [43]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  44. [44]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  45. [45]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  46. [46]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  47. [47]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  48. [48]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  49. [49]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  50. [50]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  51. [51]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  52. [52]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  53. [53]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  54. [54]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  55. [55]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  56. [56]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  57. [57]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  58. [58]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  59. [59]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  60. [60]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  61. [61]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  62. [62]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  63. [63]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  64. [64]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  65. [65]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  66. [66]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  67. [67]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  68. [68]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  69. [69]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  70. [70]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  71. [71]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  72. [72]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  73. [73]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use