Threat actor
APT32
Last fetched
APT32 is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 78 techniques and also known as 16 other names.
Also known as
SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH, OceanLotus Group, Ocean Lotus, Cobalt Kitty, Sea Lotus, APT-32, APT 32, Ocean Buffalo, POND LOACH, TIN WOODLAWN, ATK17, G0050
Description
[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)
Techniques by tactic
Discovery
- T1012 · Query Registry
- T1016 · System Network Configuration Discovery
- T1018 · Remote System Discovery
- T1033 · System Owner/User Discovery
- T1046 · Network Service Discovery
- T1049 · System Network Connections Discovery
- T1082 · System Information Discovery
- T1083 · File and Directory Discovery
- T1087.001 · Local Account
- T1135 · Network Share Discovery
Execution
- T1047 · Windows Management Instrumentation
- T1053.005 · Scheduled Task
- T1059 · Command and Scripting Interpreter
- T1059.001 · PowerShell
- T1059.003 · Windows Command Shell
- T1059.005 · Visual Basic
- T1059.007 · JavaScript
- T1072 · Software Deployment Tools
- T1203 · Exploitation for Client Execution
- T1204.001 · Malicious Link
- T1204.002 · Malicious File
- T1569.002 · Service Execution
- T1574.001 · DLL
Stealth
- T1027.010 · Command Obfuscation
- T1027.011 · Fileless Storage
- T1027.013 · Encrypted/Encoded File
- T1027.016 · Junk Code Insertion
- T1036 · Masquerading
- T1036.003 · Rename Legitimate Utilities
- T1036.004 · Masquerade Task or Service
- T1036.005 · Match Legitimate Resource Name or Location
- T1055 · Process Injection
- T1070.004 · File Deletion
- T1070.006 · Timestomp
- T1078.003 · Local Accounts
- T1216.001 · PubPrn
- T1218.005 · Mshta
- T1218.010 · Regsvr32
- T1218.011 · Rundll32
- T1564.001 · Hidden Files and Directories
- T1564.003 · Hidden Window
- T1564.004 · NTFS File Attributes
- T1574.001 · DLL
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to APT32 today — this states the absence of a published link, not that APT32 has no infrastructure.
References
- https://attack.mitre.org/groups/G0050
- https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt
- https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
- https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/
- https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
- https://attack.mitre.org/groups/G0050/
- https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/
- https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/
- https://www.brighttalk.com/webcast/10703/261205
- https://github.com/eset/malware-research/tree/master/oceanlotus
- https://www.cfr.org/interactive/cyber-operations/ocean-lotus
- https://www.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware
- https://www.secureworks.com/research/threat-profiles/tin-woodlawn
- https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/
- https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
- https://www.microsoft.com/security/blog/2020/11/30/threat-actor-leverages-coin-miner-techniques-to-stay-under-the-radar-heres-how-to-spot-them
- https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from APT32 into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.