DustSquad is a likely Russian-speaking cyber-espionage group targeting government entities and telecoms in Tajikistan.
Analyst brief
DustSquad (also tracked as Nomadic Octopus) is a likely Russian-speaking cyber-espionage group. It targets high-ranking government officials, telcos, and public service infrastructure in Tajikistan, including compromising OT devices alongside traditional IT systems. The group employs spearphishing attachments for initial access, execution via Windows Command Shell, stealth techniques like masquerading and hidden windows, and uses the Octopus malware for C2 communications. Defenders should prioritize strict email attachment analysis, monitor for abnormal process behaviors, and scrutinize network traffic, particularly against government and telecommunications sectors.
DustSquad
Nomadic Octopus
unknown
Prodaft researchers have published a report on Paperbug, a cyber-espionage campaign carried out by suspected Russian-speaking group Nomadic Octopus and which targeted entities in Tajikistan. According to Prodaft, known compromised victims included high-ranking government officials, telcos, and public service infrastructures. Compromised devices also included OT devices, besides your typical computers, servers, and mobile devices. In typical Prodaft fashion, the company also gained access to one of the group's C&C server backend panels.