{
  "id": "nomadic-octopus",
  "name": "Nomadic Octopus",
  "aliases": [
    "DustSquad"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Suspected state-linked cyber threat group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Russian-speaking group",
      "src": [
        "mitre-g0133"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2014,
      "src": [
        "mitre-g0133"
      ],
      "conf": "medium",
      "note": "At least 2014"
    },
    {
      "k": "attack_id",
      "v": "G0133",
      "src": [
        "mitre-g0133"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014.",
      "src": [
        "mitre-g0133"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 7,
      "src": [
        "mitre-g0133"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Octopus",
      "src": [
        "mitre-g0133"
      ],
      "conf": "high",
      "note": "1 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0133)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/nomadic-octopus.html",
  "sources": {
    "mitre-g0133": {
      "title": "Nomadic Octopus, Group G0133",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0133/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}