Trusted Design

Nomadic Octopus

アクターID: G0133

· MITRE Pageへのリンク

脅威アクターの詳細

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)

脅威アクターの別名・別称

Nomadic Octopus
DustSquad

利用した攻撃手法

• T1087.002 - Domain Account
• T1598.003 - Spearphishing Link
• T1558 - Steal or Forge Kerberos Tickets
• T1497.002 - User Activity Based Checks
• T1553.004 - Install Root Certificate
• T1591.004 - Identify Roles
• T1547.013 - XDG Autostart Entries

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1497.002)
• CVE-2015-1770 (T1497.002)
• CVE-2015-2545 (T1598.003)
• CVE-2017-0199 (T1497.002)
• CVE-2012-0158 (T1598.003)
• CVE-2013-3906 (T1087.002)
• CVE-2014-6352 (T1497.002)
• CVE-2015-0016 (T1598.003)
• CVE-2010-3333 (T1087.002)
• CVE-2010-0188 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2011-0611 (T1591.004)
• CVE-2010-1553 (T1598.003)
• CVE-2014-1761 (T1598.003)
• CVE-2015-2853 (T1598.003)
• CVE-2017-16929 (T1598.003)
• CVE-2012-1876 (T1598.003)
• CVE-2012-2539 (T1598.003)
• CVE-2013-3660 (T1598.003)
• CVE-2013-7331 (T1598.003)
• CVE-2009-3129 (T1598.003)
• CVE-2013-5990 (T1598.003)
• CVE-2012-4969 (T1591.004)
• CVE-2011-3544 (T1553.004)
• CVE-2014-6271 (T1591.004)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2883 (T1591.004)
• CVE-2013-0641 (T1591.004)
• CVE-2012-4792 (T1547.013)
• CVE-2010-0806 (T1547.013)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る