Forensia CTI Core

Profile

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.

MITRE ATT&CK ↗

Techniques

7 ATT&CK techniques attributed to this actor.

T1036 Masquerading T1059.001 PowerShell T1059.003 Windows Command Shell T1105 Ingress Tool Transfer T1204.002 Malicious File T1564.003 Hidden Window T1566.001 Spearphishing Attachment

Software

1 malware/tools attributed to this actor.

Octopus

Related corpus activity

9,355 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Nomadic Octopus.

Indicator	Type	Family	Sev	Src
cve-2026-1969	cve	—	85	1
cve-2022-47945	cve	—	85	1
cve-2018-8007	cve	—	85	1
cve-2021-29441	cve	—	85	1
cve-2025-7852	cve	—	85	1
cve-2025-12057	cve	—	85	1
cve-2025-0921	cve	—	85	2
cve-2024-1781	cve	—	85	1
cve-2020-22653	cve	—	85	2
cve-2026-4368	cve	ransomware	85	1
cve-2026-3844	cve	—	85	1
cve-2025-7443	cve	—	85	1
cve-2017-17215	cve	—	85	2
cve-2025-34085	cve	—	85	1
cve-2025-23304	cve	—	85	2
cve-2025-66478	cve	—	85	2
cve-2026-22584	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2026-3102	cve	—	85	3
cve-2023-44976	cve	ransomware	85	2
cve-2020-22658	cve	—	85	2
cve-2025-2492	cve	—	85	2
cve-2026-0740	cve	—	85	1
7105caa6d4fd8a2c67523d385277528e556ae4f6	hash	—	80	2
82e579bd49d69845133c9aa8585f8bd26736437b	hash	—	80	2
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5ca	sha256	phishing	80	2
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525	sha256	phishing	80	2
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194	sha256	phishing	80	2
f96bcd875836da89800912de1e557891697c7cf4	hash	—	80	2
d35695f2366a43628231e73ffa83ca106306a8fa	hash	—	80	2

Showing the top 30 by severity of 9,355.