MITRE ATT&CKgroup
G0050 APT32
- Domain
- enterprise
- Aliases
- SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH
- Version
- 3.0
- Created
- 2017-12-14
Description
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.
Related
Uses · MITRE ATT&CK (93)
- T1685.005 Clear Windows Event Logs sub-technique
- T1027.016 Junk Code Insertion sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- S1078 RotaJakiro software (malware)
- T1027.011 Fileless Storage sub-technique
- T1027.010 Command Obfuscation sub-technique
- T1608.001 Upload Malware sub-technique
- T1608.004 Drive-by Target sub-technique
- S0585 Kerrdown software (malware)
- T1589 Gather Victim Identity Information technique
- T1589.002 Email Addresses sub-technique
- T1598.003 Spearphishing Link sub-technique
- T1583.006 Web Services sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1059.007 JavaScript sub-technique
- S0477 Goopy software (malware)
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.003 Mail Protocols sub-technique
- T1571 Non-Standard Port technique
- T1078.003 Local Accounts sub-technique
- T1564.003 Hidden Window sub-technique
- T1564.004 NTFS File Attributes sub-technique
- T1574.001 DLL sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
References
- https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf Amnesty Intl. Ocean Lotus February 2021
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html FireEye APT32 May 2017
- https://www.cybereason.com/blog/operation-cobalt-kitty-apt Cybereason Oceanlotus May 2017
- https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/ ESET OceanLotus Mar 2019
- https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/ ESET OceanLotus
- https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/ Volexity OceanLotus Nov 2017
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023