- Category
- State · Attributed to a state or working for one.
- Origin
- Vietnam(high confidence)
- Sponsor
- State-sponsored
- Motivation
- Espionage; Financial gain; Information theft and espionage
- Seen
- 2012–2026
- Status
- Active
- ATT&CK
- G0050 · 78 techniques
- Sources
- 13 sources carry it
- Identifier
- GINC-APT-0011 · apt32
VietnamWhat it is
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Ocean Buffalo
- Mandiant
- APT 32
- Microsoft
- Canvas Cyclone
- MITRE ATT&CK
- G0050
- NSHC
- SectorF01
- Qihoo 360
- APT-C-00
- Thales
- ATK17
- Operations
- Operation “Cobalt Kitty”, Operation “PhantomLance”
- Other names
- Bismuth, APT 32, OceanLotus, SeaLotus, APT-32, APT-LY-100, ATK 17, Cobalt Kitty, Hive0013, Lotus Bane, Ocean Lotus, OceanLotus, OceanLotus Group, Pond Loach, Scarlet Ioke, Sea Lotus, SeaLotus, Tin Woodlawn, Woodlawn
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTVietnam
- MISP Galaxy (CFR tagging)Vietnam
- MicrosoftVietnam
- ThreatActor.info (Malpedia et al.)Vietnam · high
Chinese and Russian sources
- Qihoo 360Vietnam
Targets
- Countries
- ASEAN, Association of Southeast Asian Nations, Australia, Bangladesh, Brunei, Cambodia, China, Denmark, France, Germany, India, Indonesia, Iran, Japan, Laos, Malaysia, Myanmar, Nepal, Netherlands, Philippines, Singapore, South Korea, Thailand, United Kingdom, United States, Vietnam
- Sectors
- Civil society, Defense, Dissidents, Education, Financial, Government, Government, Administration, High-Tech, Hospitality, Journalist, Manufacturing, Media, Private sector, Retail, Technology, Telecommunications
Tools
The tools and malware families the sources tie to it.
- 0-day exploits in MS Office
- Arp
- AtNow
- CACTUSTORCH
- CamCapture Plugin
- Cobalt Strike
- CrossRat
- Cuegoe
- Cyber Eye RAT
- CyberGate
- DKMC
- Denis
- Goopy
- HiddenLotus
- KOMPROGO
- KerrDown
- Kerrdown
- METALJACK
- MSFvenom
- Mimikatz
- Net
- Nishang
- OSX_OCEANLOTUS.D
- OceanLotus
- PHOREAL
- Pagoda
- PhantomLance
- PowerSploit
- QuasarRAT
- RatSnif
- Remy
- Roland
- RotaJakiro
- SOUNDBITE
- Salgorea
- Terracotta VPN
- Veil
- WINDSHIELD
- fingerprintjs2
- ipconfig
- netsh
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de
- Qihoo 360 apt.360.net