Nomadic Octopus

Nomadic Octopus, a suspected Russian Advanced Persistent Threat (APT) group, has been engaged in a cyber-espionage campaign known as Paperbug since 2020. The group infiltrated a Tajikistani carrier to spy on government officials and public service infrastructures, compromising government networks, individual computers, and operational technology devices like gas station systems. Swiss cybersecurity company Prodaft's report indicates that the initial step towards compromising other victims was likely the infiltration of an unknown network, with the exact timing and method of infiltration remaining uncertain. Nomadic Octopus has been consistently spying on the carrier since November 2020, taking screenshots particularly when targeted victims were writing emails or creating new contracts for their customers. The threat actor used multiple servers as Command and Control (C2) for its backdoors and tools in the Paperbug campaign. ESET, a cybersecurity firm, has identified only one type of malware used by Nomadic Octopus and found evidence that the group has been active since at least 2015, indicating a high level of persistence. Anton Cherepanov, a senior malware researcher at ESET, confirmed that the hackers may speak Russian based on the spear-phishing emails they send out and the use of Russian malware filenames. Despite the ongoing operations of Nomadic Octopus, the cybersecurity industry continues to work diligently to understand and combat this threat. ESET detailed the threat actor’s operations at the Virus Bulletin conference earlier this month, providing valuable insights into the group's tactics, techniques, and procedures. As the threat landscape continues to evolve, understanding the modus operandi of groups like Nomadic Octopus is crucial in developing effective defense strategies and maintaining cybersecurity resilience.