G0050
APT32
Observation period
78
Techniques
0
Reports
- Latest observed activity
- No dated reports available
- First observed
- —
Profile
Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.
Relevance for Germany, Austria and Switzerland
high
Assessment based on target countries according to MISP Galaxy (CFR Cyber Operations Tracker).
Target sectors according to source
- Government
- Private sector
- Civil society
Target countries according to source China, Germany, United States, Vietnam, Philippines, Association of Southeast Asian Nations
Aliases
- OceanLotus Group
- Ocean Lotus
- Cobalt Kitty
- APT-C-00
- SeaLotus
- APT-32
- Ocean Buffalo
- POND LOACH
- TIN WOODLAWN
- BISMUTH
- ATK17
- Canvas Cyclone
MITRE ATT&CK techniques
Observed techniques per ATT&CK Enterprise and ICS. Each technique links to the ATT&CK knowledge base.
- T1550.002
- T1036
- T1059.007
- T1047
- T1072
- T1570
- T1564.004
- T1552.002
- T1055
- T1216.001
- T1566.001
- T1135
- T1033
- T1571
- T1082
- T1583.001
- T1012
- T1027.010
- T1059.003
- T1048.003
- T1574.001
- T1566.002
- T1598.003
- T1087.001
- T1059.001
- T1003.001
- T1046
- T1608.004
- T1041
- T1036.004
- T1003
- T1078.003
- T1589
- T1070.006
- T1189
- T1218.011
- T1059
- T1112
- T1071.003
- T1560
- T1204.001
- T1071.001
- T1036.005
- T1070.004
- T1027.011
- T1105
- T1053.005
- T1036.003
- T1543.003
- T1608.001
- T1222.002
- T1569.002
- T1018
- T1218.005
- T1083
- T1685.005
- T1059.005
- T1588.002
- T1021.002
- T1550.003
- T1583.006
- T1505.003
- T1564.001
- T1016
- T1027.016
- T1049
- T1564.003
- T1027.013
- T1056.001
- T1589.002
- T1218.010
- T1068
- T1585.001
- T1137
- T1203
- T1204.002
- T1547.001
- T1102
Software / tooling used
External references
- Amnesty International. (2021, February 24). Vietnamese activists targeted by notorious hacking group. Retrieved March 1, 2021.Amnesty Intl. Ocean Lotus February 2021, amnestyusa.org
- Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.FireEye APT32 May 2017, fireeye.com
- Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.Cybereason Oceanlotus May 2017, cybereason.com
- Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.ESET OceanLotus Mar 2019, welivesecurity.com
- Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.ESET OceanLotus, welivesecurity.com
- Lassalle, D., et al. (2017, November 6). OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society. Retrieved November 6, 2017.Volexity OceanLotus Nov 2017, volexity.com
- Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.Microsoft Threat Actor Naming July 2023, learn.microsoft.com
- attack.mitre.orgattack.mitre.org
- scmagazineuk.comscmagazineuk.com
- brighttalk.combrighttalk.com
- github.comgithub.com
- cfr.orgcfr.org
- accenture.comaccenture.com
- secureworks.comsecureworks.com
- trendmicro.comtrendmicro.com
- microsoft.commicrosoft.com
- about.fb.comabout.fb.com