State-backedVietnam MITRE G0050

APT32

Also known as OceanLotus Group, Ocean Lotus, OceanLotus, Cobalt Kitty, APT-C-00, SeaLotus, Sea Lotus, APT-32, APT 32, Ocean Buffalo, POND LOACH, TIN WOODLAWN, BISMUTH, ATK17, G0050, Canvas Cyclone

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

Targets: Government, Private sector, Civil society, China, Germany, United States, Vietnam, Philippines, Association of Southeast Asian Nations

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003 OS Credential Dumping T1003.001 LSASS Memory T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1021.002 SMB/Windows Admin Shares T1027.010 Command Obfuscation T1027.011 Fileless Storage T1027.013 Encrypted/Encoded File T1027.016 Junk Code Insertion T1033 System Owner/User Discovery T1036 Masquerading T1036.003 Rename Legitimate Utilities T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1041 Exfiltration Over C2 Channel T1046 Network Service Discovery T1047 Windows Management Instrumentation T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1049 System Network Connections Discovery T1053.005 Scheduled Task T1055 Process Injection T1056.001 Keylogging T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1068 Exploitation for Privilege Escalation T1070.004 File Deletion T1070.006 Timestomp T1071.001 Web Protocols T1071.003 Mail Protocols T1072 Software Deployment Tools T1078.003 Local Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1102 Web Service T1105 Ingress Tool Transfer T1112 Modify Registry T1135 Network Share Discovery T1137 Office Application Startup T1189 Drive-by Compromise T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1216.001 PubPrn T1218.005 Mshta T1218.010 Regsvr32 T1218.011 Rundll32 T1222.002 Linux and Mac Permissions T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder T1550.002 Pass the Hash T1550.003 Pass the Ticket T1552.002 Credentials in Registry T1560 Archive Collected Data T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1564.004 NTFS File Attributes T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1569.002 Service Execution T1570 Lateral Tool Transfer T1571 Non-Standard Port T1574.001 DLL T1583.001 Domains T1583.006 Web Services T1585.001 Social Media Accounts T1588.002 Tool T1589 Gather Victim Identity Information T1589.002 Email Addresses T1598.003 Spearphishing Link T1608.001 Upload Malware T1608.004 Drive-by Target T1685.005 Clear Windows Event Logs

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.