APT32

    VietnamState-sponsoredUnknown

    Observation period

    78

    Techniques

    0

    Reports

    Latest observed activity
    No dated reports available
    First observed
    —

    Profile

    Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

    Relevance for Germany, Austria and Switzerland

    high

    Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).

    Target sectors according to source

    • Government
    • Private sector
    • Civil society

    Target countries according to source China, Germany, United States, Vietnam, Philippines, Association of Southeast Asian Nations

    Aliases

    • OceanLotus Group
    • Ocean Lotus
    • OceanLotus
    • Cobalt Kitty
    • APT-C-00
    • SeaLotus
    • Sea Lotus
    • APT-32
    • APT 32
    • Ocean Buffalo
    • POND LOACH
    • TIN WOODLAWN
    • BISMUTH
    • ATK17
    • Canvas Cyclone

    MITRE ATT&CK techniques

    Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.

    Software / tooling used

    External references

    Back to group overview