README.md

Primal Snail

Primal Snail, also known as Nomadic Octopus, is a Russian-speaking cyber espionage group active since at least 2014, primarily targeting Central Asian entities such as local governments, diplomatic missions, and individuals. The group employs custom malware, notably the Octopus Trojan written in Delphi, to infiltrate Windows and Android platforms. In 2020, Primal Snail conducted the "Paperbug" campaign, compromising a Tajikistani telecom provider to spy on government officials and public service infrastructures.

• The full report is available here

Paperbug Campaign Indicators of Compromise (IOC)

Backdoor C2 Domains & IPs

islandsnake.com
footcoinball.com
lovingearthy.com
silentseayear.com
94.140.114.20
44.227.76.166
44.227.65.245
91.219.238.239
91.208.184.79
54.36.185.101
188.241.58.142
199.188.200.245

Victim Panel IP

185.99.133.244

Threat Actor's Server IPs

185.32.126.102
194.180.174.154

VPN Server IP

86.106.137.150

Backdoors

SHA256
062ba92736257f6ec1f16e33a8ae507732ab900404785d5f14b05cf4cecd05c2
979f8156c2f70fb8d699e12bed0d952254688fbcdf385bd4ab54a4ce615c1c3f
cf8d4ba73c7ebea33ac737f2c95fcc5afab7613cae46362c547141e09ad2239a
f5203ec8d5259157fd40f2646f0139558293f1dd94727bc9cc328432cdde5779
6f3882642fa180c5422cbc08f6ad38270964be0cf52fcf91d630b731ae3fc31e
b0e2fe5ef2f37eb88f288929ee774a555a19eb5b01a2ca03b3d30ec98604ad22

Cobalt Strike

SHA256
b0e2fe5ef2f37eb88f288929ee774a555a19eb5b01a2ca03b3d30ec98604ad22