APT32 has used COM scriptlets to download Cobalt Strike beacons.(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.(Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT32 malware has used rundll32.exe to execute an initial infection process.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT32 used the

APT32 has deployed tools after moving laterally using administrative accounts.(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|An

APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|