Nomadic Octopus

Executive Summary

Nomadic Octopus is a Russian-speaking cyber espionage threat group targeting Central Asian governments, diplomatic missions, and individuals since at least 2014. Known for using custom Android and Windows malware built with the Delphi programming language, the group has demonstrated sophisticated capabilities tailored to espionage objectives.

Goals & Targeting

Nomadic Octopus's primary motivation appears to be espionage, with a focus on compromising diplomatic and governmental entities in Central Asia. By targeting these sectors, the group likely seeks to obtain classified or sensitive data that could provide geopolitical advantages to its sponsors. The geographic focus on Russia and Central Asian countries aligns with potential state-backed operations aiming to influence regional dynamics.

Nomadic Octopus is an active cyber espionage threat actor primarily targeting Central Asian countries, including local governments, diplomatic missions, and individuals. The group has been observed since at least 2014, employing a variety of tactics involving Android and Windows-based malware. These tools are often custom-built using the Delphi programming language, showcasing a focus on evading detection while maintaining functionality. The actor has demonstrated persistence in targeting the government sector, suggesting a strategic intent to gather sensitive information for espionage purposes.

Key Capabilities

• Custom Android malware
• Custom Windows malware using Delphi
• Spear-phishing campaigns
• Malicious file distribution via email attachments

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Nomadic Octopus has conducted long-term campaigns targeting Central Asian governments, indicating a patient and strategic approach. The group's use of custom malware suggests a high level of technical expertise tailored to specific operations. Campaign patterns include the deployment of malicious files through spear-phishing emails, often leveraging Windows PowerShell or command-line tools for execution.

IOC Patterns

• Spearphishing attachments with malicious links
• Malicious files dropped from compromised email accounts
• Windows-based malware using Delphi programming language
• Hidden window creation to avoid detection

Recommended Actions

• Implement robust email filtering solutions to detect spear-phishing attempts.
• Monitor for PowerShell and command-line tool activity indicative of malicious behavior.
• Conduct regular updates and patches on all operating systems to mitigate known vulnerabilities.
• Use endpoint detection and response (EDR) tools to identify hidden or anomalous processes.

Suggested Tags