APT / THREAT GROUP

Octopus

aliases

Last seen:Mar 17, 2026

Intelligence Profile

The author describes Octopus as an "open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S."

It is different from the malware win.octopus written in Delphi and attributed to DustSquad by Kaspersky Labs.

Threat Analysis

Octopus is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://isc.sans.edu/diary/26918

→https://mp.weixin.qq.com/s/v1gi0bW79Ta644Dqer4qkw

→https://securelist.com/octopus-infested-seas-of-central-asia/88200/

→https://www.prodaft.com/m/reports/PAPERBUG_TLPWHITE-1.pdf

Quick Facts

TypeAPT / Threat Group

Aliases3

Also Known As

ps1.octopuswin.octopusOctopus

External Intelligence

Malpedia: win.octopus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Octopus