APT32
threat actorVNalso known as
Other names and identifiers for this entity.
ATT&CK
APT-C-00 · APT32 · BISMUTH · Canvas Cyclone · OceanLotus · SeaLotus
MISP
APT-C-00 · APT32 · ATK17 · BISMUTH · Canvas Cyclone · Cobalt Kitty · Ocean Buffalo · Ocean Lotus · OceanLotus Group · POND LOACH · SeaLotus · TIN WOODLAWN
Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.
resolved ATT&CK groups
Threat groups associated with this.
techniques used (78)
ATT&CK techniques this enables or maps to.
software used (15)
Malware and tools associated with this.
references
External citations — patches, advisories, analysis.
- https://attack.mitre.org/groups/G0050/
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html
- https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/
- https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/
- https://www.brighttalk.com/webcast/10703/261205
- https://github.com/eset/malware-research/tree/master/oceanlotus
- https://www.cfr.org/interactive/cyber-operations/ocean-lotus
- https://www.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware