APT32

Threat Actors · APT32

· ATT&CK GroupG0050

SeaLotusOceanLotusAPT-C-00Canvas CycloneBISMUTH

Techniques

Software

Tactics

Aliases

Description

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)

Tactic Coverage

stealth (20)execution (13)discovery (10)persistence (7)privilege escalation (6)resource development (6)lateral movement (5)command and control (5)credential access (4)initial access (4)defense impairment (3)reconnaissance (3)exfiltration (2)collection (2)

Techniques Used (78)

T1003OS Credential Dumping

credential access

T1003.001LSASS Memory

credential access

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 78 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (15)

S0099Arptool S0154Cobalt Strikemalware S0354Denismalware S0477Goopymalware S0156KOMPROGOmalware S0585Kerrdownmalware S0002Mimikatztool S0039Net

References (14)

https://attack.mitre.org/groups/G0050 https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html https://www.cybereason.com/blog/operation-cobalt-kitty-apt https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide