Nomadic Octopus

Overview

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.

Naming & attribution

Nomadic Octopus is tracked under 2 names across the industry. It uses 7 documented ATT&CK techniques — more than 20% of the 174 groups tracked here. Activity attributed since at least 2014.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• DarkHydrus — 4 shared techniques (40% overlap)
• Gorgon Group Pakistan — 6 shared techniques (35% overlap)
• Rancor — 4 shared techniques (33% overlap)
• TA459 China — 3 shared techniques (33% overlap)
• TA551 — 5 shared techniques (31% overlap)
• Ajax Security Team Iran — 3 shared techniques (30% overlap)

TTPs — 7 techniques across 4 tactics

Tools & malware (1)

Octopus

Reporting (3)

• Russia-Linked Hackers Target Diplomatic Entities in Central Asia — Kovacs, E
• Russia-linked APT group DustSquad targets diplomatic entities in Central Asia — Paganini, P
• Octopus-infested seas of Central Asia — Kaspersky Lab's Global Research & Analysis Team