APT32's backdoor has modified the Windows Registry to store the backdoor's configuration. (Citation: ESET OceanLotus Mar 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

APT32's backdoor can query the Windows Registry to gather system information. (Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT32's backdoor possesses the capability to list files and directories on a machine. (Citation: ESET OceanLotus Mar 2019)

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1137|Office Application Startup|

APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|