Procedure examples

Octopus can exfiltrate files from the system using a documents collector tool.

Octopus can collect the host IP address from the victim’s machine.

Octopus can collect the username from the victim’s machine.

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.

Octopus has used wmic.exe for local discovery information.

Octopus has used HTTP GET and POST requests for C2 communications.

Octopus has stored collected information in the Application Data directory on a compromised host.

Octopus can collect the computer name, OS version, and OS architecture information.

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.

Octopus can download additional files and tools onto the victim’s machine.

Octopus can capture screenshots of the victims’ machine.

Octopus has encoded C2 communications in Base64.

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.

Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.

Octopus has been delivered via spearsphishing emails.

Octopus has exfiltrated data to file sharing sites.

Octopus can collect system drive and disk size information.