APT32

APT32, widely known as OceanLotus, is a Vietnam-linked, state-sponsored cyberespionage group associated with operations against corporate targets and organizations across Asia and other regions. Other tracking names include APT-C-00, ATK17, Bismuth, Canvas Cyclone, Lotus Bane, Ocean Buffalo, POND LOACH, SeaLotus, SectorF01, and TIN WOODLAWN. Its targeting includes Vietnam, China, the Philippines, Germany, Cambodia, Laos, and the United States. Operation Cobalt Kitty is associated with the group. APT32 gains initial access through spearphishing links and malicious attachments, including executables disguised as documents or spreadsheets. It uses command shells, PowerShell, and Visual Basic scripts, combining backdoors with publicly available tools such as Cobalt Strike and Mimikatz. Its defense-evasion techniques include PowerShell obfuscation with Invoke-Obfuscation, disguising payloads as legitimate installers, and injecting Cobalt Strike beacons into legitimate Windows processes. The group establishes persistence through Registry autorun entries, scheduled tasks, newly created or modified Windows services, and web shells on compromised websites. It harvests credentials using Mimikatz and customized credential-dumping utilities, enumerates domain controllers and remote systems with native Windows commands, and uses pass-the-hash authentication and administrative accounts for lateral movement and subsequent tool deployment. APT32 has also exploited CVE-2016-7255 for local privilege escalation.