DustSquad

DustSquad, also known as Nomadic Octopus, is a notable threat actor that has been implicated in several cyber-espionage campaigns. Throughout 2018, DustSquad, along with other actors like IndigoZebra and Sofacy, targeted political entities in Central Asia using the Octopus malware. This was revealed through monitoring efforts and the use of Kaspersky's Attribution Engine, which identified Octopus as related to DustSquad based on similarity algorithms. Interestingly, DustSquad's choice of programming language for Octopus was Delphi, an unusual choice for such an actor. In April 2018, Kaspersky researchers discovered a new sample of DustSquad’s Windows malware, dubbed Octopus. While both DustSquad and Sofacy have been linked to Russia, and their respective malwares were found on compromised machines, Kaspersky believes these threat actors are not related. This highlights the complexity and diversity of the threat landscape, with multiple actors potentially targeting the same victims independently. Swiss cybersecurity company Prodaft reported on the Paperbug cyber-espionage campaign, attributing it to DustSquad. DustSquad's activities have been closely monitored, with private intelligence reports being provided to customers detailing four of their campaigns involving custom Android and Windows malware. Despite the shared use of Delphi as a programming language between DustSquad's Octopus and Sofacy's Zebrocy, the groups appear to operate separately, further emphasizing the multifaceted nature of cyber threats.