APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT32 has sent spearphishing emails containing malicious links.(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: FireEye APT32 April 2020)(Citation: Volexity Ocean Lotus November 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

APT32 has used mshta.exe for code execution.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT32 used the

APT32 used the

APT32 has enumerated DC servers using the command

APT32 used NTFS alternate data streams to hide their payloads.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|

APT32 has used pass the hash for lateral movement.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|