APT32 - G0050

Created: 2017-12-14T16:46:06.044Z

Modified: 2023-03-21T21:04:18.158Z

Contributors: Romain Dumont, ESET

Aliases

APT32,SeaLotus,OceanLotus,APT-C-00

Description

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)

Techniques Used

APT32's backdoor has stored its configuration in a registry key.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

APT32 has used the

APT32 has obtained and used tools such as

Mimikatz and

Cobalt Strike, and a variety of other open-source tools from GitHub.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1589|Gather Victim Identity Information|