Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · DustSquad · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

DustSquad

  • Nomadic Octopus

MITRE G0133 ↗

DustSquad — ATT&CK roseDU

attack rose · 7 techniques across 4 tactics

Analyst brief

misp-galaxy + mitre-attack

Prodaft researchers have published a report on Paperbug, a cyber-espionage campaign carried out by suspected Russian-speaking group Nomadic Octopus and which targeted entities in Tajikistan. According to Prodaft, known compromised victims included high-ranking government officials, telcos, and public service infrastructures. Compromised devices also included OT devices, besides your typical computers, servers, and mobile devices. In typical Prodaft fashion, the company also gained access to one of the group's C&C server backend panels.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

7 techniques · 4 of 15 tactics

  1. Initial access

    1 technique

  2. Execution

    3 techniques

  3. Stealth

    2 techniques

  4. Command and control

    1 technique

select a technique

Arsenal

1 malware
Malware
Malware · 1ATT&CK
OctopusS0340 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

7 sources
  1. 1.securelist.com/octopus-infested-seas-of-central-asia/88200
  2. 2.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf
  3. 3.virusbulletin.com/conference/vb2018/abstracts/nomadic-octopus-cyber-espi…
  4. 4.attack.mitre.org/groups/G0133
  5. 5.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-O…
  6. 6.securityweek.com/russia-linked-hackers-target-diplomatic-entities-centr…
  7. 7.securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html

Track DustSquad on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.