Skip to content

APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

ATT&CK ID: G0050
Origin: Vietnam
Weather family: Cyclone
Techniques: 55
Tools: 15

Also tracked as SeaLotus · OceanLotus · APT-C-00 · Canvas Cyclone · BISMUTH

Vulnerabilities it has exploited

Techniques

Reconnaissance

Gather Victim Identity Information Phishing for Information

Resource Development

Acquire Infrastructure Establish Accounts Obtain Capabilities Stage Capabilities

Initial Access

Valid Accounts Drive-by Compromise Phishing

Execution

Windows Management Instrumentation Scheduled Task/Job Command and Scripting Interpreter Software Deployment Tools Exploitation for Client Execution User Execution System Services Hijack Execution Flow

Persistence

Scheduled Task/Job Valid Accounts Modify Registry Office Application Startup Server Software Component Create or Modify System Process Boot or Logon Autostart Execution

Privilege Escalation

Scheduled Task/Job Process Injection Exploitation for Privilege Escalation Valid Accounts Create or Modify System Process Boot or Logon Autostart Execution

Stealth

Obfuscated Files or Information Masquerading Process Injection Indicator Removal Valid Accounts System Script Proxy Execution System Binary Proxy Execution Hide Artifacts Hijack Execution Flow

Defense Impairment

Modify Registry File and Directory Permissions Modification Disable or Modify Tools

Credential Access

OS Credential Dumping Input Capture Unsecured Credentials

Discovery

Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery System Information Discovery File and Directory Discovery Account Discovery Network Share Discovery

Lateral Movement

Remote Services Software Deployment Tools Use Alternate Authentication Material Lateral Tool Transfer

Collection

Input Capture Archive Collected Data

Command and Control

Application Layer Protocol Web Service Ingress Tool Transfer Non-Standard Port

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Alternative Protocol

Software

Arp · Cobalt Strike · Denis · Goopy · KOMPROGO · Kerrdown · Mimikatz · Net · OSX_OCEANLOTUS.D · PHOREAL · RotaJakiro · SOUNDBITE · WINDSHIELD · ipconfig · netsh

MITRE ATT&CK All threat actors