OceanLotusMalware
According to PcRisk, Research shows that the OceanLotus 'backdoor' targets MacOS computers. Cyber criminals behind this backdoor have already used this malware to attack human rights and media organizations, some research institutes, and maritime construction companies.From MISP Galaxy
Last reported 1 month ago, by AhnLab ASEC9 reports
ATT&CK techniques
6 of 61 · each with the sentence it comes from- T1036Masquerading
“T1036”
- T1105Ingress Tool Transfer
“Script-based execution (such as PowerShell, VBScript, CMD, and JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS-based C2 communication, local system data collection, and data exfiltration via C2 paths were repeatedly observed.”
- T1027Obfuscated Files or Information
“T1027”
- T1055Process Injection
“T1055”
- T1059Command and Scripting Interpreter
“T1059”
- T1195Supply Chain Compromise
“… APT Threat Trends report summarizes attack cases in which state-sponsored threat actors combined attacks involving open-source supply chain compromises, the use of generative AI, the exploitation of legitimate cloud services, job scams, and the exploitation of zero-day vulnerabi…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
August 2026 Threat Trend Report on APT Groups“Armored Likho, Awaken Likho, Core Werewolf, Dark Caracal, Darkhotel, Head Mare, and OceanLotus (APT32) also carried out attacks exploiting legitimate services and software such as Telegram, GitLab, GitHub, OneDrive, TrueConf, and Sogou Input Method, respectively.”
-
July 2026 Threat Trend Report on APT Groups“OceanLotus utilized IMG images, LNK files, DLL sideloading, and registry hive-based persistence.”
-
OceanLotus: del espionaje exterior al foco en objetivos en Vietnam“OceanLotus: del espionaje exterior al foco en objetivos en Vietnam”
-
OceanLotus: From external espionage to domestic targeting“OceanLotus: From external espionage to domestic targeting”
-
2024: Revisiting a Year in Threats“August revealed that the highly resourceful (and truly heartless) APT, OceanLotus, had been targeting Vietnamese human rights defenders for over four years with sophisticated persistence methods.”
-
APT Targeting Vietnamese Human Rights Defenders“This intrusion has a number of overlaps with known techniques used by the threat actor APT32/OceanLotus, and a known target demographic which aligns with APT32/OceanLotus targets.”
-
Elastic charms SPECTRALVIPER“We are attributing REF2754 to a Vietnamese-based intrusion set and aligning with the Canvas Cyclone/APT32/OceanLotus threat actor”
-
PHOREAL Malware Targets the Southeast Asian Financial Sector“It has been reported in other research as being used exclusively by APT32 (AKA SeaLotus, OceanLotus, APT-C-00, Group G0050).”
-
“We find many things that others do not even see”“About two years ago, Facebook released a report about the notorious APT32 group, also called OceanLotus and linked to the Vietnamese government.”
Indicators in its reports
named in the reports above- metakit.fireant[.]vnin 2 reports
- hxxp://metakit.fireant[.]vn/Software/version.xmlin 2 reports
- 139.162.11[.]152in 2 reports
- 142.91.98[.]77in 2 reports
- hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement.htmlin 2 reports
- financemachinelearning[.]comin 2 reports
- gatewayrvcenter[.]comin 2 reports
- 139.180.128[.]42in 2 reports
- coachcybersecurity[.]comin 2 reports
- 139.99.33[.]239in 2 reports
- mxprodesign[.]comin 2 reports
- 166.88.77[.]186in 2 reports
- power-sync-services[.]comin 2 reports
- 103.119.47[.]104in 2 reports
- 511b77459673ec42…1d233b6c39fbin 2 reports
- 59a8553a4f8130f5…0be4d4da0e98in 2 reports
- 9ca1a5c7f79882db…26bcdcb9f6ddin 2 reports
- a8e2bbbfcb865003…12755ab0c165in 2 reports
- f74f1feb62b662cd…27824e55acb9in 2 reports
- f8f8209987ca7f13…e21bd2ae93a9in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.