8 malware familiesExploits CVEs in the wild

Nomadic Octopus

Also known asDustSquadNomadic Octopus

Nomadic Octopus, also referred to as DustSquad, is a threat actor observed targeting diplomatic entities in several Central Asian countries. The content associates the actor with the Octopus Trojan. Reported tradecraft includes spearphishing emails with malicious attachments used to lure victims into opening files, malicious file execution, and the use of malicious macros to download additional files onto victim systems. For execution, Nomadic Octopus has used PowerShell, including running PowerShell in a hidden window, and has used cmd.exe /c within a malicious macro. The content maps the actor to ATT&CK techniques including T1059.001 (PowerShell), T1059.003 (Windows Command Shell), T1129 (Shared Modules), and T1204.002 (Malicious File Execution).

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

MITRE ATT&CK

Tradecraft

29 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

10 of 15 tactics35 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0043

Reconnaissance

1 technique

T1592

Gather Victim Host Information

TA0042

Resource Development

1 technique

T1608

Stage Capabilities

TA0001

Initial Access

1 technique

T1566

Phishing

T1566.001×21

Spearphishing Attachment

T1566.002×4

Spearphishing Link

TA0002

Execution

4 techniques

T1059×2

Command and Scripting Interpreter

T1059.001×23

PowerShell

T1059.003×3

Windows Command Shell

T1129

Shared Modules

T1204

User Execution

T1204.001

Malicious Link

T1204.002×13

Malicious File

T1574

Hijack Execution Flow

TA0004

Privilege Escalation

1 technique

T1055

Process Injection

TA0005

Stealth

5 techniques

T1027

Obfuscated Files or Information

T1027.005

Indicator Removal from Tools

T1036

Masquerading

T1036.008

Masquerade File Type

T1055

Process Injection

T1564

Hide Artifacts

T1564.003×3

Hidden Window

T1564.006×2

Run Virtual Instance

T1574

Hijack Execution Flow

TA0007

Discovery

4 techniques

T1012

Query Registry

T1087

Account Discovery

T1087.002

Domain Account

T1482

Domain Trust Discovery

T1518

Software Discovery

TA0011

Command and Control

3 techniques

T1071

Application Layer Protocol

T1071.001

Web Protocols

T1105×9

Ingress Tool Transfer

T1573

Encrypted Channel

T1573.002

Asymmetric Cryptography

TA0010

Exfiltration

1 technique

T1041

Exfiltration Over C2 Channel

TA0040

Impact

1 technique

T1531

Account Access Removal

ARSENAL

Associated malware families

8 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

AkinakOctopus is only one of DustSquad’s tools, along with other Windows and Android malware such as Zaka, Akinak and Harpoon.1Mar 18, 2026

Cobalt StrikeDetects the PowerShell pattern used at the end of a Cobalt Strike PowerShell loader to perform the decompression of the executable. This loader is used in attacks such as scripted web delivery. Cobalt Strike is a legitimate, commercial penetration testing tool that has been largely co-opted by ransomware gangs to launch attacks. Cobalt Strike's popularity is mainly due to its beacons or payload being stealthy, and easily customizable. Cobalt Strike Beacon provides encrypted communication with the C&C server to send information and receive commands.1May 6, 2026

FgDumpWe have previously seen DustSquad use third-party post-exploitation tools, such as the password dumping utility fgdump1Mar 18, 2026

HarpoonOctopus is only one of DustSquad’s tools, along with other Windows and Android malware such as Zaka, Akinak and Harpoon.1Mar 18, 2026

NetSupport RMMThe following analytic detects the loading of specific dynamic-link libraries (DLLs) associated with the NetSupport Remote Manager (RMM) tool... This helps to identify instances where the legitimate NetSupport tool is being misused by adversaries as a Remote Access Trojan (RAT).1Mar 17, 2026

3 additional families tracked in Mallory.

WEAPONIZED

Associated vulnerabilities

1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

20 SOURCESView more in app

splunk researchNews

Apr 22, 2026

Detection: PowerShell PInvoke Process Injection API Chain | Splunk Security Content

Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.

splunk researchNews

Apr 20, 2026

Detection: PowerShell Environment Variable Execution | Splunk Security Content

Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows Binary Execution from an Archive | Splunk Security Content

Listed as a threat actor associated with the malicious file execution technique detected by this analytic.

splunk researchNews

Apr 13, 2026

Detection: Windows Cobalt Strike PowerShell Loader | Splunk Security Content

Listed as a threat actor associated with use of Cobalt Strike PowerShell loader patterns.

+112 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping29

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal8

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs1

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.