ESET Nomadic Octopus 2018

Octopus can exfiltrate files from the system using a documents collector tool.

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Nomadic Octopus has used PowerShell for execution.

Nomadic Octopus used cmd.exe /c within a malicious macro.

Octopus has used HTTP GET and POST requests for C2 communications.

Octopus has stored collected information in the Application Data directory on a compromised host.

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.

Octopus can download additional files and tools onto the victim’s machine.

Nomadic Octopus has used malicious macros to download additional files to the victim's machine.

Octopus can capture screenshots of the victims’ machine.

Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.

Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.

Octopus has compressed data before exfiltrating it using a tool called Abbrevia.

Nomadic Octopus executed PowerShell in a hidden window.

Octopus has been delivered via spearsphishing emails.

Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.

Octopus has exfiltrated data to file sharing sites.