KINWILDER

APT32

No sourced public emblem in this profile.

reference profile · reported nexus: VN (not nationality)

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

Source-reported aliases: OceanLotus Group, Ocean Lotus, OceanLotus, Cobalt Kitty, APT-C-00, SeaLotus, Sea Lotus, APT-32, APT 32, Ocean Buffalo, POND LOACH, TIN WOODLAWN, BISMUTH, ATK17, G0050, Canvas Cyclone. Associations do not prove equivalence.

Target geography

Catalog-listed countries (associations, not attack counts): China · Germany · United States of America · Vietnam · Philippines

No bound claim-post feed for this label.

Historical casebook

No dated record curated yet; absence does not establish inactivity.

Planned Kinwilder coverage

Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.

No assigned review window.

References

Pinned source catalog

https://attack.mitre.org/groups/G0050/

https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html

https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/

https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/

https://www.brighttalk.com/webcast/10703/261205

https://github.com/eset/malware-research/tree/master/oceanlotus

https://www.cfr.org/interactive/cyber-operations/ocean-lotus

https://www.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware

https://www.secureworks.com/research/threat-profiles/tin-woodlawn

https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/

https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html

https://www.microsoft.com/security/blog/2020/11/30/threat-actor-leverages-coin-miner-techniques-to-stay-under-the-radar-heres-how-to-spot-them

https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam

Submission and profile-update guide · Publisher API

Editorial standard · root@kinwilder.com · RSS · Outpost