Securelist Octopus Oct 2018

Octopus can collect the host IP address from the victim’s machine.

Octopus can collect the username from the victim’s machine.

Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.

Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.

Octopus has used wmic.exe for local discovery information.

Octopus has used HTTP GET and POST requests for C2 communications.

Octopus has stored collected information in the Application Data directory on a compromised host.

Octopus can collect the computer name, OS version, and OS architecture information.

Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.

Octopus can download additional files and tools onto the victim’s machine.

Octopus can capture screenshots of the victims’ machine.

Octopus has encoded C2 communications in Base64.

Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.

Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.

Octopus can collect system drive and disk size information.