Paperbug

Paperbug is a cyber-espionage campaign executed by a suspected Russian threat actor known as Nomadic Octopus, also referred to as DustSquad. The Swiss cybersecurity company Prodaft has released a report detailing the actions of this group, outlining their tactics, techniques, and procedures (TTPs). The Paperbug operation, which started in 2020, has been targeting government networks, individual computers, and operational technology devices in Tajikistan, including gas station systems. These attacks have resulted in significant data breaches, with the threat actor stealing emails, documents, messaging application chat histories, and even spying on victims in real time. Nomadic Octopus leveraged multiple servers as command and control (C2) points for its backdoors and tools used in the Paperbug campaign. The group expanded its access through document theft, stolen clients' contracts and credentials, exploitation of weak network security configurations, and unpatched software and services. The malware deployed shows similarities to the previously analyzed Octopus and allows the attackers to execute various commands on the victims’ machines, highlighting the sophisticated nature of the threat actor's capabilities. The TTPs observed in Operation Paperbug align closely with the attack patterns associated with Russia-linked threat actors like the Sofacy APT. This intelligence-driven operation poses a significant threat to national security and business continuity, given its focus on both governmental and commercial targets. As such, organizations are advised to bolster their cybersecurity measures and stay vigilant against potential threats.