Loading story…
Amnesty International reported that Vietnamese human rights defenders and a rights organization were targeted in a coordinated spyware campaign attributed to Ocean Lotus (APT32) between 2018 and 2020. Identified victims included blogger and activist Bui Thanh Hieu, the nonprofit VOICE (Vietnamese Overseas Initiative for Conscience Empowerment), and another Vietnam-based blogger whose identity was withheld for safety reasons. The operation used phishing emails carrying malicious attachments or links, then delivered malware for macOS and Windows while displaying decoy documents to disguise the intrusion.
On Windows systems, the attackers deployed Kerrdown and then Cobalt Strike to expand access and control over compromised devices. The activity fits a broader pattern of reporting on Ocean Lotus operations targeting Vietnamese civil society, media, and other entities, with multiple investigations describing the group as aligned with Vietnamese state interests, although Amnesty said it could not independently prove a direct link to the Vietnamese government. Amnesty said the surveillance campaign formed part of a wider environment of repression, censorship, arrests, harassment, and online restrictions affecting activists in Vietnam, and called for an independent investigation and tighter controls on surveillance technology.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Amnesty International reported that a coordinated spyware campaign targeting Vietnamese human rights defenders and a human rights organization ran from February 2018 through November 2020. The activity used phishing emails with malicious attachments or links to deliver MacOS or Windows malware.
Amnesty International's Security Lab disclosed a coordinated spyware campaign affecting Bui Thanh Hieu, VOICE, and another Vietnamese blogger, and attributed the activity to Ocean Lotus. Amnesty said the campaign deployed Kerrdown and then Cobalt Strike on Windows systems, while noting it could not independently prove a direct link to the Vietnamese government.
Bayerischer Rundfunk published an investigation titled "Lined up in the sights of Vietnamese hackers" about Ocean Lotus activity. The reference provides the publication date but no explicit separate event date beyond the publication itself.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET attributed a targeted supply-chain attack to **OceanLotus** (`APT32`), saying the Vietnam-aligned espionage group compromised the update server for **FireAnt MetaKit**, a software component used by Vietnamese stock investors, and pushed malicious updates between October 2025 and March 2026. The tampered updates delivered a downloader that used DLL side-loading to install the **SPECTRALVIPER** backdoor, with researchers saying the operation was selective rather than a broad mass infection campaign. FireAnt MetaKit’s update process reportedly lacked integrity checks and TLS protection, allowing attackers to replace legitimate packages and abuse the trusted update channel. Researchers said the malware used HTTPS for command-and-control, injected into `OneDrive.Sync.Service.exe`, and relied on infrastructure including `financemachinelearning[.]com`, while a parallel OceanLotus intrusion hit an unnamed Vietnamese infrastructure and transport construction company after suspected exploitation of remote code execution flaws in a public-facing Microsoft SQL Server. Multiple SPECTRALVIPER variants were then used for persistence, profiling, and lateral movement. The campaigns indicate a sharper OceanLotus focus on domestic Vietnamese surveillance, including targets tied to finance, infrastructure, and potentially politically sensitive anti-corruption and market investigations.
Jun 29, 2026
ESET reported that the **OceanLotus** threat group updated its macOS malware toolkit, extending a campaign long associated with targeted espionage. The revised malware was designed to compromise Apple systems used by selected victims and maintain covert access, showing that the group continued to invest in cross-platform capabilities rather than relying only on Windows-focused tooling. The report tied the activity to a broader pattern of **advanced persistent threat** operations in which OceanLotus adapts implants and delivery methods to fit the victim environment. The macOS update underscored the group’s focus on stealth, persistence, and intelligence collection, and highlighted that Apple endpoints were being actively targeted as part of the actor’s wider surveillance campaigns.
Jun 29, 2026
Recorded Future reported that **APT32** launched a malware campaign targeting the Cambodian government. The activity was attributed to the Vietnam-linked threat group, also known as **OceanLotus**, and was described as part of a cyber-espionage effort aimed at government entities in Cambodia. The operation used malware associated with APT32 to compromise targeted systems and collect intelligence, underscoring the group’s continued focus on regional political and governmental targets in Southeast Asia. The campaign added to prior reporting on APT32’s long-running use of tailored intrusion activity to support state-aligned espionage objectives.
Jul 12, 2026