MalwareUsed by 1 actorExploits 1 CVE

PHOREAL

PHOREAL is a malware family associated with the Vietnam-aligned espionage threat actor APT32, also known as OceanLotus. Reporting cited in the content identifies PHOREAL as one of APT32’s signature malware payloads, alongside WINDSHIELD, KOMPROGO, and SOUNDBITE, and places its use in APT32 intrusions targeting private-sector organizations, foreign governments, dissidents, journalists, and entities with business interests in Vietnam. Specific victim sectors mentioned in the supporting content for APT32 activity include manufacturing, consumer products, hospitality, banking, media, network security, and technology infrastructure, with examples including 2016 targeting of U.S. consumer products organizations.

Capabilities directly attributed to PHOREAL in the content include command-and-control over ICMP, Windows Registry manipulation, and creation of a reverse shell. The content also notes that APT32 backdoors modified the Windows Registry to store backdoor configuration, which is consistent with PHOREAL’s listed Registry manipulation capability, but no more specific registry paths or configuration details are provided for PHOREAL itself.

The broader APT32 intrusion tradecraft described in the source material includes spear-phishing emails delivering ActiveMime ".mht" lure documents disguised as ".doc" files that entice victims to enable macros, after which multiple payloads are downloaded from remote servers. However, the content does not explicitly state that PHOREAL itself is the payload delivered by that vector in every case. No PHOREAL-specific hashes, filenames, domains, IPs, or other unique indicators of compromise are provided in the content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2016-7255Win32k Elevation of Privilege VulnerabilityExploited in the wild

During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix.

via web archiveweb.archive.org

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT32

Some of the key tools in its arsenal include SOUNDBITE (aka Denis), PHOREAL (aka Rizzo), WINDSHIELD (aka Remy), and, more recently, SPECTRALVIPER...

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

“APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros… APT32 actors continue to deliver the malicious attachments via spear-phishing emails.”

Execution

5 techniques

T1053.005Scheduled TaskEvidence1

“the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system.”

T1059.001PowerShellEvidence1

“delivered as a multi-stage PowerShell script… delivered as shellcode in a PowerShell script…”

T1059.003Windows Command ShellEvidence3

The content repeatedly describes use of cmd.exe, cmd /c, Windows command shell, and xp_cmdshell to execute commands, run payloads, launch binaries, perform reconnaissance, persistence, cleanup, and ransomware actions. Examples include: 'Sandworm Team used the xp_cmdshell command in MS-SQL', 'APT41 used cmd.exe /c to execute commands on remote machines', and many malware families 'can use cmd.exe to execute commands on a compromised host.' | Many entries explicitly state malware 'can create a reverse shell' or 'launch a remote shell,' including 4H RAT, AuditCred, BLACKCOFFEE, Carbanak, DarkComet, Exaramel for Windows, PlugX, QuasarRAT, and ZxShell.

T1059.005Visual BasicEvidence1

“The Base64 encoded ActiveMime data also contained an OLE file with malicious macros.”

T1204.002Malicious FileEvidence1

“APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros.”

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

“the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system.”

T1112Modify RegistryEvidence6

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

“the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system.”

Stealth

2 techniques

T1036MasqueradingEvidence2

“installed one backdoor as a persistent service with a legitimate service name… Another backdoor used an otherwise legitimate DLL filename…”

T1218.005MshtaEvidence1

“This second task ran ‘mshta.exe’ every 50 minutes…”

Defense Impairment

1 technique

T1112Modify RegistryEvidence6

Command and Control

3 techniques

T1095Non-Application Layer ProtocolEvidence3

"Anchor has used ICMP in C2 communications." / "COATHANGER uses ICMP for transmitting configuration information..." / "PHOREAL communicates via ICMP for C2." / "Regin ... can use ICMP to communicate between infected computers." / "Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications."

T1105Ingress Tool TransferEvidence2

“Upon execution, the initialized file downloads multiple malicious payloads from remote servers.”

T1219Remote Access ToolsEvidence1

4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

INDICATORS OF COMPROMISE

IOCs tracked for this family

61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

50 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

11 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

8 SOURCESView more in app

the hacker newsNews

Jun 11, 2026

OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

A malware tool identified as part of OceanLotus's arsenal.

web archiveNews

May 14, 2017

Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations " Threat Research Blog | FireEye Inc

Backdoor using ICMP for C2, with reverse shell capability plus filesystem/registry manipulation, process creation, and file upload.

mitre attackNews

Jan 25, 2026

Modify Registry, Technique T1112 - Enterprise | MITRE ATT&CK®

Malware capable of manipulating the Windows Registry.

mitre attackNews

Jan 25, 2026

Command and Scripting Interpreter: Windows Command Shell, Sub-technique T1059.003 - Enterprise | MITRE ATT&CK®

Malware/tool capable of creating a reverse shell.

+3 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching61

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.