Russian-language actor exploits hype over Telegram ban in Central Asia

guest · Oct 15, 2018

Octopus-infested seas of Central Asia
Russian-language actor exploits hype over Telegram ban in Central Asia
October 15, 2018
https://securelist.com/octopus-infested-seas-of-central-asia/88200/

For the last two years we have been monitoring a Russian-language cyberespionage actor that focuses on Central Asian users and diplomatic entities. We named the actor DustSquad [...] In this blogpost we cover a malicious program for Windows called Octopus that mostly targets diplomatic entities.

[...] Malware persistence is basic and achieved via the system registry. The server side uses commercial hosting in different countries with .php scripts deployed. Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen.
Technical details
The attackers used the potential Telegram ban in Kazakhstan to push its dropper as an alternative communication software for the political opposition.
[...] Besides the Trojan itself, the Octopus developers used the password dumping utility fgdump.
Click to expand...

Log in or Sign up

Russian-language actor exploits hype over Telegram ban in Central Asia

guest Guest

Log in or Sign up

Russian-language actor exploits hype over Telegram ban in Central Asia

guest Guest

Useful Searches