Loading threat actor…
OceanLotus, also known as APT-C-00 and 海莲花, is a highly active Southeast Asian advanced persistent threat group widely associated with cyber-espionage operations. The group has been documented targeting government entities, research organizations, and other strategic institutions, including attacks against Chinese organizations. Its operations commonly align with intelligence collection objectives and use socially engineered lures tied to current events and geopolitical themes. OceanLotus has used topical decoys based on major public events, including COVID-19 and avian influenza, to target government bodies and related scientific research laboratories. Pandemic-themed lures formed part of a broader pattern in which the group targeted government, military, and medical-sector entities and associated personnel. The actor is known for spearphishing and other lure-driven initial access methods, with campaigns tailored to the interests and responsibilities of intended victims. The group’s observed tradecraft includes initial access through phishing and malicious documents, credential-focused social engineering, persistence, defense evasion, and post-compromise activity consistent with long-term espionage intrusions. OceanLotus is part of the cluster of threat activity most prominently associated with Southeast Asia and is regarded as one of the region’s most active APT actors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced only in the appendix as an example of another APT group previously named by the research team.
Highly active Southeast Asian APT group using epidemic-themed lures to target Chinese government and research labs, including DLL sideloading via WPS to deploy its malware.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.