🇷🇺

DustSquad

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

Nomadic Octopus

Target Countries 3

Countries highlighted in red

Afghanistan China Kazakhstan

Sectors Targeted

Telecommunications 517 Media Government diplomats and dissidents Defense

Details

Origin 🇷🇺 RU

Last Updated 08 Nov 2023

MITRE ATT&CK 13

T1036 T1059 T1059.001 T1059.003 T1071 T1105 T1193 T1204 T1204.002 T1564 T1564.003 T1566 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 5 entries

DustSquad Kaspersky

Golden Falcon Qihoo 360

APT-C-34 Qihoo 360

Nomadic Octopus ESET

G0133 MITRE

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

Afghanistan Kazakhstan Central Asia

Description

(Kaspersky) For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users and diplomatic entities. We named the actor DustSquad and have provided private intelligence reports to our customers on four of their campaigns involving custom Android and Windows malware. In this blogpost we cover a malicious program for Windows called Octopus that mostly targets diplomatic entities. The name was originally coined by ESET in 2017 after the 0ct0pus3.php script used by the actor on their old C2 servers. We also started monitoring the malware and, using Kaspersky Attribution Engine based on similarity algorithms, discovered that Octopus is related to DustSquad, something we reported in April 2018. In our telemetry we tracked this campaign back to 2014 in the former Soviet republics of Central Asia (still mostly Russian-speaking), plus Afghanistan.

Tools Used 4

Harpoon Octopus Paperbug Remote Control System

Operations 1

2020 Nomadic Octopus’ Paperbug Campaign https://www.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf

Reports & References 2

https://securelist.com/octopus-infested-seas-of-central-asia/88200/ https://www.zdnet.com/article/extensive-hacking-operation-discovered-in-kazakhstan/

ETDA Profile

DustSquad, Golden Falcon

Origin

Russia

First Seen 2014

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0133/

View on ETDA APT Groups ↗