Nomadic Octopus
Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--fed4f0a2-4347-4530-b0f5-6dfd49b29172
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-01T16:36:58+00:00
- Origin source
- attack_description
- Type
- intrusion-set
- Origin country
- RU
MITRE ATT&CK Techniques (7)
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be display
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external ad
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to ope
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masqueradin
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environ
Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems. Spearphishing attachment is a sp
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the prima
Software & Tools (1)
Octopus is a Windows Trojan written in the Delphi programming language that has been used by [Nomadic Octop
Explore this actor's full graph with Ninja Signal