LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0669: KOCTOPUS

KOCTOPUS's batch variant is loader used by LazyScripter since 2018 to launch Octopus and Koadic and, in some cases, QuasarRAT. KOCTOPUS also has a VBA variant that has the same functionality as the batch version.[1]

EnterpriseS0669MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

KOCTOPUS matters because it is described as a Windows loader used to launch follow-on remote access tooling such as Octopus, Koadic, and in some cases QuasarRAT. For leaders, the practical issue is not only the loader itself, but whether phishing-driven script execution, PowerShell/cmd/VBA activity, registry persistence, tool transfer, and stealth behaviors would be visible quickly enough to support containment decisions.

Executive priority

Prioritize KOCTOPUS as a validation case for Windows endpoint resilience, phishing response readiness, and SOC visibility over script-based malware chains. The relationship to LazyScripter, which MITRE describes as mainly targeting the airlines industry since at least 2018, makes this especially relevant for organizations with aviation exposure or similar operational-continuity requirements. Executives should ask whether email security, endpoint logging, PowerShell/script controls, registry monitoring, and incident response evidence preservation are sufficient to reconstruct and contain a loader-to-RAT sequence.

Technical view

ATT&CK does not provide a dedicated detection section for KOCTOPUS, so defenders should validate coverage through the related behaviors: spearphishing links or attachments leading to user execution; batch, PowerShell, Windows command shell, and VBA execution; command obfuscation and deobfuscation; registry modification and Run Key or Startup Folder persistence; UAC bypass attempts; hidden windows; system information discovery; ingress tool transfer; proxy use for command and control; and possible security tool impairment or cleanup of persistence artifacts. Detection engineering should correlate email, endpoint process, script, registry, file-transfer, and network telemetry rather than relying on a single malware signature.

Likely telemetry

  • Email gateway and user-reporting evidence for suspicious attachments and links
  • Windows process creation telemetry for cmd.exe, PowerShell, script hosts, Office-spawned processes, and unusual parent-child chains
  • PowerShell script block, module, and command-line logging where available
  • Command-line content showing obfuscation, decoding, or suspicious interpreter usage
  • Registry auditing for Run Keys, Startup Folder changes, and other suspicious modifications

Detection direction

  • Validate phishing-to-execution correlation: email event, user interaction, spawned script/interpreter, and downloaded or launched payload should be linkable in the SOC workflow.
  • Tune for suspicious Windows interpreter chains involving batch files, PowerShell, cmd, VBA, and Office-originated execution, while accounting for legitimate administrative scripting.
  • Add analytic focus on obfuscated command lines and subsequent decode/deobfuscation behavior instead of matching only static strings.
  • Monitor registry persistence and cleanup together; removal of persistence artifacts can be part of adversary tradecraft and may erase evidence needed by incident responders.
  • Correlate ingress tool transfer with later execution of known remote access tooling families referenced by MITRE, without assuming every event is KOCTOPUS.

Mitigation priorities

  • Reduce phishing execution risk through attachment/link controls, user reporting workflows, and rapid triage of suspected spearphishing events.
  • Harden Windows script execution paths with least privilege, controlled use of PowerShell, and restrictions appropriate to business operations.
  • Protect persistence points by monitoring and limiting unauthorized registry and Startup Folder changes.
  • Ensure endpoint security and logging agents are tamper-resistant and generate alerts when disabled, modified, or stopped.
  • Maintain egress visibility through DNS, proxy, and network logging so potential proxy or tool-transfer behavior can be investigated.
Additional notes and limits

The supplied ATT&CK object identifies KOCTOPUS as a loader with batch and VBA variants and links it to LazyScripter and multiple techniques. The strongest defensive value is using KOCTOPUS as a scenario for validating Windows script execution, phishing response, persistence monitoring, and follow-on tool detection. Local baselines are essential because many related behaviors overlap with legitimate administration.

MITRE does not provide official detection guidance for this object, and the object’s own tactics are not specified. Several related techniques include platforms beyond Windows, but KOCTOPUS itself is supplied here as Windows; platform statements should therefore remain Windows-focused unless local evidence expands scope. No active exploitation, customer exposure, or guaranteed detection coverage is implied.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

KOCTOPUS

KOCTOPUS's batch variant is loader used by LazyScripter since 2018 to launch Octopus and Koadic and, in some cases, QuasarRAT. KOCTOPUS also has a VBA variant that has the same functionality as the batch version.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
DomainIDNameRelationship / procedure
EnterpriseT1685Disable or Modify Tools

KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.[1]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

KOCTOPUS has been distributed via spearphishing emails with malicious attachments.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

KOCTOPUS has deobfuscated itself before executing its commands.[1]

EnterpriseT1204.002Malicious FileSub-technique

KOCTOPUS has relied on victims clicking a malicious document for execution.[1]

EnterpriseT1090Proxy

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.[1]

EnterpriseT1112Modify Registry

KOCTOPUS has added and deleted keys from the Registry.[1]

EnterpriseT1566.002Spearphishing LinkSub-technique

KOCTOPUS has been distributed as a malicious link within an email.[1]

EnterpriseT1082System Information Discovery

KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.[1]

EnterpriseT1564.003Hidden WindowSub-technique

KOCTOPUS has used -WindowsStyle Hidden to hide the command window.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

KOCTOPUS has used `cmd.exe` and batch files for execution.[1]

EnterpriseT1105Ingress Tool Transfer

KOCTOPUS has executed a PowerShell command to download a file to the system.[1]

EnterpriseT1204.001Malicious LinkSub-technique

KOCTOPUS has relied on victims clicking on a malicious link delivered via email.[1]

EnterpriseT1070.009Clear PersistenceSub-technique

KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.[1]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.[2]

EnterpriseT1106Native API

KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.[1]

EnterpriseT1059.001PowerShellSub-technique

KOCTOPUS has used PowerShell commands to download additional files.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.[1]

EnterpriseT1027.010Command ObfuscationSub-technique

KOCTOPUS has obfuscated scripts with the BatchEncryption tool.[1]

EnterpriseT1059.005Visual BasicSub-technique

KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

KOCTOPUS can set the AutoRun Registry key with a PowerShell command.[1]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1070.009: Clear PersistenceEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · GroupG0140: LazyScripterEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
03fe1b6e635b0dfd...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle03fe1b6e635b…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  2. [2]
    Arghire LazyScripter

    Ionut Arghire. (2021, February 24). New ‘LazyScripter’ Hacking Group Targets Airlines. Retrieved January 10, 2024.

    Open source URL
  3. [3]
    KOCTOPUS

    (Citation: MalwareBytes LazyScripter Feb 2021)

  4. [4]
    KOCTOPUS

    (Citation: MalwareBytes LazyScripter Feb 2021)

  5. [5]
    KOCTOPUS

    (Citation: MalwareBytes LazyScripter Feb 2021)

  6. [6]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  7. [7]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  8. [8]
    mitre-attackS0669
    Open source URL
  9. [9]
    mitre-attackS0669
    Open source URL
  10. [10]
    mitre-attackS0669
    Open source URL
  11. [11]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  12. [12]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  13. [13]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  14. [14]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  15. [15]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  16. [16]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  17. [17]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  18. [18]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  19. [19]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  20. [20]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  21. [21]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  22. [22]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  23. [23]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  24. [24]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  25. [25]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  26. [26]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  27. [27]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  28. [28]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  29. [29]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  30. [30]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  31. [31]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  32. [32]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  33. [33]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  34. [34]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  35. [35]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  36. [36]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  37. [37]
    Arghire LazyScripter

    Ionut Arghire. (2021, February 24). New ‘LazyScripter’ Hacking Group Targets Airlines. Retrieved January 10, 2024.

    Open source URL
  38. [38]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  39. [39]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  40. [40]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  41. [41]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  42. [42]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  43. [43]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  44. [44]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  45. [45]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  46. [46]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  47. [47]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  48. [48]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  49. [49]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use