Nomadic Octopus
Nomadic Octopus is a Russia-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 11 sectors, including Government and Manufacturing, in 7 countries, including the United States and France. It uses 30 MITRE ATT&CK techniques.
- APTC34
- DustSquad
- Origin
- Russia
- Techniques
- 30
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2014
- Last seen
- Nov 1, 2020
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
30 techniques across 10 of 14 tacticsReconnaissance3
System Owner/User Discovery
Application Layer Protocol: Web Protocols
System Information Discovery
Resource Development1
Hardware Additions
Initial Access3
User Execution: Malicious File
Archive Collected Data: Archive via Utility
Phishing: Spearphishing Attachment
Execution6
Windows Management Instrumentation
Process Injection
Command and Scripting Interpreter: PowerShell
Command and Scripting Interpreter: Windows Command Shell
Ingress Tool Transfer
Hijack Execution Flow: DLL Side-Loading
Persistence2
Event Triggered Execution: Change Default File Association
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation·
Defense Evasion4
Masquerading
Masquerading: Match Legitimate Resource Name or Location
Data Encoding: Standard Encoding
Hide Artifacts: Hidden Window
Credential Access1
Input Capture: Keylogging
Discovery4
System Network Configuration Discovery
Data Staged: Local Data Staging
File and Directory Discovery
Local Storage Discovery
Lateral Movement·
Command and Control·
Exfiltration3
Exfiltration Over C2 Channel
Exfiltration Over Alternative Protocol
Exfiltration Over Web Service: Exfiltration to Cloud Storage
Impact·
Arsenal · Malware And Tools.
- Harpoonmalware
- Octopusmalware
- Pegasus for Androidmalware
- RCSmalware
- Fgdumptool
- Framaroottool
- TeamViewertool
Campaigns.
- APT-C-34 Central Asian Espionage CampaignNov 2019
- Octopus Central Asia Espionage CampaignOct 2018
Indicators Of Compromise.
TLP:AMBER8 indicators on the Brandefense platform
IP, domain and hash indicators · YARA rules · ATT&CK Navigator export
Request A DemoAbout Nomadic Octopus.
Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.
Last updated Nov 3, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.