APT32

APT32 is a Vietnamese state-affiliated espionage threat actor widely known as OceanLotus and also tracked as Canvas Cyclone, BISMUTH, Cobalt Kitty, SeaLotus, Ocean Buffalo, Lotus Bane, Pond Loach, and several other vendor-specific aliases. The group has conducted long-running cyber espionage operations aligned with Vietnamese strategic interests and has targeted governments, dissidents, journalists, foreign corporations, and organizations in sectors such as finance, telecommunications, transportation, construction, and broader critical or strategically important industries in Southeast Asia and beyond. APT32 is known for combining targeted intrusion tradecraft with custom malware development, social engineering, and supply-chain compromise. Reported operations have included targeting Vietnamese stock investors and infrastructure- and transportation-related companies through a compromised software supply chain associated with FireAnt MetaKit. The group has also been linked to campaigns targeting Chinese cybersecurity professionals and malware analysts. The actor uses a diverse malware ecosystem and loaders, including families such as SPECTRALVIPER, P8LOADER, POWERSEAL, and DONUTLOADER in activity overlapping with OceanLotus. Observed tradecraft includes DLL side-loading, process injection, shellcode staging, masquerading as legitimate software, in-memory evasion of AMSI and ETW, encrypted command-and-control over web protocols, and use of named pipes for local or alternate command channels. APT32 malware has supported capabilities such as PE loading, token theft and impersonation, file upload and download, directory manipulation, and execution of additional payloads. On compromised systems, APT32 has performed extensive host fingerprinting and discovery. Reported behaviors include collecting operating system version and computer name, querying the Windows Registry for system information, and fingerprinting macOS hosts during initial beaconing. The group has also used shellcode to identify infected hostnames. Persistence and configuration storage frequently rely on Windows Registry abuse. APT32 has established persistence through Registry Run keys to launch PowerShell scripts, Visual Basic scripts, and backdoor components, and has modified the Registry to store backdoor configuration data. ATT&CK techniques associated with the group include PowerShell execution, exploitation for privilege escalation, setuid and setgid abuse in Linux-focused emulation and detection mappings, registry-based persistence, registry discovery, and broader command-and-scripting interpreter use. APT32 should be understood as a mature, state-aligned intrusion set with flexible tooling, strong operational security, and a history of adapting delivery and persistence mechanisms to victim environments. Its operations consistently emphasize stealth, post-compromise reconnaissance, durable persistence, and intelligence collection in support of Vietnamese national interests.