Threat intelligence / Group

APT32

[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

93 recorded

Relationships

uses

to Archive Collected Data

Technique

uses

to Arp

Tool

uses

to Clear Windows Event Logs

Technique

uses

to Cobalt Strike

Malware

uses

to Command and Scripting Interpreter

Technique

uses

to Command Obfuscation

Technique

uses

to Credentials in Registry

Technique

uses

to Denis

Malware

uses

to DLL

Technique

uses

to Domains

Technique

uses

to Drive-by Compromise

Technique

uses

to Drive-by Target

Technique

uses

to Email Addresses

Technique

uses

to Encrypted/Encoded File

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exploitation for Client Execution

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Fileless Storage

Technique

uses

to Gather Victim Identity Information

Technique

uses

to Goopy

Malware

uses

to Hidden Files and Directories

Technique

uses

to Hidden Window

Technique

uses

to Ingress Tool Transfer

Technique

uses

to ipconfig

Tool

uses

to JavaScript

Technique

uses

to Junk Code Insertion

Technique

uses

to Kerrdown

Malware

uses

to Keylogging

Technique

uses

to KOMPROGO

Malware

uses

to Lateral Tool Transfer

Technique

uses

to Linux and Mac Permissions

Technique

uses

to Local Account

Technique

uses

to Local Accounts

Technique

uses

to LSASS Memory

Technique

uses

to Mail Protocols

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Masquerade Task or Service

Technique

uses

to Masquerading

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Mimikatz

Tool

uses

to Modify Registry

Technique

uses

to Mshta

Technique

uses

to Net

Tool

uses

to netsh

Tool

uses

to Network Service Discovery

Technique

uses

to Network Share Discovery

Technique

uses

to Non-Standard Port

Technique

uses

to NTFS File Attributes

Technique

uses

to Office Application Startup

Technique

uses

to OS Credential Dumping

Technique

uses

to OSX_OCEANLOTUS.D

Malware

uses

to Pass the Hash

Technique

uses

to Pass the Ticket

Technique

uses

to PHOREAL

Malware

uses

to PowerShell

Technique

uses

to Process Injection

Technique

uses

to PubPrn

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Regsvr32

Technique

uses

to Remote System Discovery

Technique

uses

to Rename Legitimate Utilities

Technique

uses

to RotaJakiro

Malware

uses

to Rundll32

Technique

uses

to Scheduled Task

Technique

uses

to Service Execution

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Social Media Accounts

Technique

uses

to Software Deployment Tools

Technique

uses

to SOUNDBITE

Malware

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to Spearphishing Link

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Timestomp

Technique

uses

to Tool

Technique

uses

to Upload Malware

Technique

uses

to Visual Basic

Technique

uses

to Web Protocols

Technique

uses

to Web Service

Technique

uses

to Web Services

Technique

uses

to Web Shell

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Service

Technique

uses

to WINDSHIELD

Malware

14 external

References

mitre-attack

G0050

open

SeaLotus

—

APT-C-00

—

APT32

—

OceanLotus

—

Canvas Cyclone

—

BISMUTH

—

Amnesty Intl. Ocean Lotus February 2021

https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf

open

FireEye APT32 May 2017

https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html

open

Cybereason Oceanlotus May 2017

https://www.cybereason.com/blog/operation-cobalt-kitty-apt

open

ESET OceanLotus Mar 2019

https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/

open

ESET OceanLotus

https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/

open

Volexity OceanLotus Nov 2017

https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/

open

Microsoft Threat Actor Naming July 2023

https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide

open