APT32Threat actor
- apt 32
- apt-32
- apt-c-00
- atk17
- bismuth
- Canvas Cyclone
- cobalt kitty
- g0050
- ocean buffalo
- ocean lotus
- oceanlotus group
- pond loach
- sea lotus
- sealotus
- tin woodlawn
Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists.From MISP Galaxy
Last reported 1 month ago, by AhnLab ASEC8 reports
ATT&CK techniques
6 of 60 · each with the sentence it comes from- T1036Masquerading
“T1036”
- T1027Obfuscated Files or Information
“T1027”
- T1055Process Injection
“T1055”
- T1059Command and Scripting Interpreter
“T1059”
- T1105Ingress Tool Transfer
“T1105”
- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
August 2026 Threat Trend Report on APT Groups“Armored Likho, Awaken Likho, Core Werewolf, Dark Caracal, Darkhotel, Head Mare, and OceanLotus (APT32) also carried out attacks exploiting legitimate services and software such as Telegram, GitLab, GitHub, OneDrive, TrueConf, and Sogou Input Method, respectively.”
-
OceanLotus: del espionaje exterior al foco en objetivos en Vietnam“OceanLotus, también conocido como APT32, es un grupo de ciberespionaje presuntamente alineado con los intereses del gobierno vietnamita.”
-
OceanLotus: From external espionage to domestic targeting“OceanLotus, also known as APT32, is a cyberespionage group allegedly aligned with the interests of the Vietnamese government.”
-
APT Targeting Vietnamese Human Rights Defenders“This intrusion has a number of overlaps with known techniques used by the threat actor APT32/OceanLotus, and a known target demographic which aligns with APT32/OceanLotus targets.”
-
Elastic charms SPECTRALVIPER“We are attributing REF2754 to a Vietnamese-based intrusion set and aligning with the Canvas Cyclone/APT32/OceanLotus threat actor”
-
PHOREAL Malware Targets the Southeast Asian Financial Sector“It has been reported in other research as being used exclusively by APT32 (AKA SeaLotus, OceanLotus, APT-C-00, Group G0050).”
-
Playing defense against Gamaredon Group“For example, these same techniques have also been associated with threat groups like APT32 and are leveraged by malware families such as AgentTesla and BabyShark.”
-
“We find many things that others do not even see”“About two years ago, Facebook released a report about the notorious APT32 group, also called OceanLotus and linked to the Vietnamese government.”
Indicators in its reports
named in the reports above- metakit.fireant[.]vnin 2 reports
- hxxp://metakit.fireant[.]vn/Software/version.xmlin 2 reports
- 139.162.11[.]152in 2 reports
- 142.91.98[.]77in 2 reports
- hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement.htmlin 2 reports
- financemachinelearning[.]comin 2 reports
- gatewayrvcenter[.]comin 2 reports
- 139.180.128[.]42in 2 reports
- coachcybersecurity[.]comin 2 reports
- 139.99.33[.]239in 2 reports
- mxprodesign[.]comin 2 reports
- 166.88.77[.]186in 2 reports
- power-sync-services[.]comin 2 reports
- 103.119.47[.]104in 2 reports
- 511b77459673ec42…1d233b6c39fbin 2 reports
- 59a8553a4f8130f5…0be4d4da0e98in 2 reports
- 9ca1a5c7f79882db…26bcdcb9f6ddin 2 reports
- a8e2bbbfcb865003…12755ab0c165in 2 reports
- f74f1feb62b662cd…27824e55acb9in 2 reports
- f8f8209987ca7f13…e21bd2ae93a9in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.