LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0340: Octopus

Octopus is a Windows Trojan written in the Delphi programming language that has been used by Nomadic Octopus to target government organizations in Central Asia since at least 2014.[1][2][3]

EnterpriseS0340MalwareObject v2.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

S0340: Octopus describes [Octopus](https://attack.mitre.org/software/S0340) is a Windows Trojan written in the Delphi programming language that has been used by [Nomadic Octopus](https://attack.mitre.org/groups/G0133) to target government organizations in Central Asia since at least 2014.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)

Executive priority

S0340: Octopus is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0340: Octopus by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata
  • Network, endpoint, and security-tool telemetry

Detection direction

  • Validate whether S0340: Octopus appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Octopus

Octopus is a Windows Trojan written in the Delphi programming language that has been used by Nomadic Octopus to target government organizations in Central Asia since at least 2014.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

19 rows
DomainIDNameRelationship / procedure
EnterpriseT1005Data from Local System

Octopus can exfiltrate files from the system using a documents collector tool.[3]

EnterpriseT1033System Owner/User Discovery

Octopus can collect the username from the victim’s machine.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Octopus has encoded C2 communications in Base64.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.[1][3]

EnterpriseT1016System Network Configuration Discovery

Octopus can collect the host IP address from the victim’s machine.[1]

EnterpriseT1083File and Directory Discovery

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.[1][2][3]

EnterpriseT1567.002Exfiltration to Cloud StorageSub-technique

Octopus has exfiltrated data to file sharing sites.[3]

EnterpriseT1082System Information Discovery

Octopus can collect the computer name, OS version, and OS architecture information.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.[1]

EnterpriseT1074.001Local Data StagingSub-technique

Octopus has stored collected information in the Application Data directory on a compromised host.[1][3]

EnterpriseT1560.001Archive via UtilitySub-technique

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.[3]

EnterpriseT1047Windows Management Instrumentation

Octopus has used wmic.exe for local discovery information.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Octopus has used HTTP GET and POST requests for C2 communications.[1][3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Octopus has been delivered via spearsphishing emails.[3]

EnterpriseT1105Ingress Tool Transfer

Octopus can download additional files and tools onto the victim’s machine.[1][2][3]

EnterpriseT1680Local Storage Discovery

Octopus can collect system drive and disk size information.[1]

EnterpriseT1204.002Malicious FileSub-technique

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.[3]

EnterpriseT1113Screen Capture

Octopus can capture screenshots of the victims’ machine.[1][2][3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0133: Nomadic Octopus

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · GroupG0133: Nomadic OctopusEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1567.002: Exfiltration to Cloud StorageEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1074.001: Local Data StagingEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1113: Screen CaptureEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.2
Object version
2.1
Created
Modified
Raw hash
468c6511b7f6f09f...
Imported snapshots across ATT&CK releases(2)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.22.1Current bundle468c6511b7f6…
19.12.1Older bundle468c6511b7f6…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Securelist Octopus Oct 2018

    Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.

    Open source URL
  2. [2]
    Security Affairs DustSquad Oct 2018

    Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.

    Open source URL
  3. [3]
    ESET Nomadic Octopus 2018

    Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.

    Open source URL
  4. [4]
    Octopus

    (Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)

  5. [5]
    mitre-attackS0340
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use