Loading story…
OceanLotus (also tracked as APT32) conducted a broad cyber-espionage campaign targeting critics of the Vietnamese state, journalists, human rights activists, NGOs, foreign governments, hospitals, businesses, and media organizations. Reporting tied the group to spear-phishing, watering-hole attacks, malicious websites, fake news portals, social media personas, shortened links, malicious Android apps, and credential theft operations designed to surveil victims and selectively deliver malware. Individual targets included Vietnamese writer Bui Thanh Hieu and Berlin-based journalist Marina Mai, while researchers also linked the operation to compromised sites and surveillance activity across Cambodia, Laos, and the Philippines.
Security firms and platform operators said the group maintained a long-running, well-resourced infrastructure and evolved its tradecraft from phishing-heavy operations to direct intrusions against high-value targets using 0-day and N-day vulnerabilities. Observed tooling included Cobalt Strike, Mimikatz, Empire, DLL side-loading, PowerShell-based host profiling, custom loaders, and malware such as Remy RAT, with some activity linked by Facebook to CyberOne Group in Vietnam. Facebook said it removed accounts and pages, blocked associated domains, notified targeted users, and shared indicators and YARA rules with industry partners as researchers continued to document the group’s regional surveillance and lateral movement capabilities.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
Facebook announced enforcement action against APT32 in Vietnam, removed associated accounts and Pages, blocked related domains, and notified targeted users. It linked the operation to CyberOne Group and published indicators including hashes, domains, and YARA rules.
Marina Mai learned in late 2020 that attackers had attempted to install spyware on her computer. CPJ said the targeting was linked to OceanLotus and used spear-phishing.
QiAnXin reported that from mid-2020 OceanLotus gradually moved away from spear-phishing and began directly intruding into high-value targets. The report said the group used 0-day and N-day vulnerabilities during intrusion and lateral movement.
Bui Thanh Hieu closed his blog in early 2020 because he feared for his family's safety. The closure followed sustained pressure and targeting tied to his criticism of the Vietnamese state.
FireEye published a report on APT32 and its threat to global corporations. The reference establishes a public reporting milestone on the group's cyber-espionage activity.
Volexity released research in 2017 describing a large OceanLotus digital surveillance campaign. According to CPJ, the campaign involved about 120 hacked sites, roughly 90 of them media and human rights organizations.
QiAnXin said Tianyan Lab first publicly disclosed and named OceanLotus in May 2015. This was presented as the group's first public identification.
After fleeing to Germany in 2013, Bui Thanh Hieu continued writing about Vietnamese politics on his blog Nguoi Buon Gio and on Facebook. His continued activism formed part of the context for later targeting.
QiAnXin reported that OceanLotus activity could be traced back to April 2012, marking the earliest stated start of the group's operations. The group was described as targeting victims across East Asia, Southeast Asia, and Europe.
Bui Thanh Hieu was detained in 2009 for writing critically about Vietnam's territorial disputes with China. This predates the later cyber targeting described against him.
QiAnXin published a technical analysis of OceanLotus covering its direct-intrusion methods, lateral movement scripts, host profiling, use of Empire, Mimikatz, Cobalt Strike, and Remy RAT, and its DLL-based loaders. The report also described a mining component masquerading as vmware-authd.exe.
CPJ reported that OceanLotus had targeted journalists including Marina Mai and Bui Thanh Hieu with spear-phishing and malware-laced messages. The article also highlighted prior research tying the group to compromised websites and surveillance of media and human rights organizations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
ti.qianxin.com
Open sourcecpj.org
Open sourceabout.fb.com
Open sourcefireeye.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amnesty International reported that Vietnamese human rights defenders and a rights organization were targeted in a coordinated spyware campaign attributed to **Ocean Lotus** (`APT32`) between 2018 and 2020. Identified victims included blogger and activist **Bui Thanh Hieu**, the nonprofit **VOICE** (Vietnamese Overseas Initiative for Conscience Empowerment), and another Vietnam-based blogger whose identity was withheld for safety reasons. The operation used phishing emails carrying malicious attachments or links, then delivered malware for **macOS** and **Windows** while displaying decoy documents to disguise the intrusion. On Windows systems, the attackers deployed **Kerrdown** and then **Cobalt Strike** to expand access and control over compromised devices. The activity fits a broader pattern of reporting on Ocean Lotus operations targeting Vietnamese civil society, media, and other entities, with multiple investigations describing the group as aligned with Vietnamese state interests, although Amnesty said it could not independently prove a direct link to the Vietnamese government. Amnesty said the surveillance campaign formed part of a wider environment of repression, censorship, arrests, harassment, and online restrictions affecting activists in Vietnam, and called for an independent investigation and tighter controls on surveillance technology.
Aug 14, 2026
ESET reported that the **OceanLotus** threat group, also tracked as **APT32** and **APT-C-00**, deployed an updated backdoor against company and government networks in East Asia. The intrusion chain relied on social-engineering lures, including double-extension decoy files and fake software installers such as `RobototFontUpdate.exe`, to deliver a multi-stage dropper and backdoor. The malware used layered obfuscation, encrypted payloads, and shellcode-based PE loading to hinder analysis and detection. The campaign also abused **DLL side-loading** through legitimate signed executables, including Symantec’s `rastlsc.exe`, to execute malicious components while appearing trustworthy. After installation, the backdoor established persistence through a Windows service or `Run` registry key, then communicated with command-and-control servers over TCP port `25123` with fallback HTTP/HTTPS channels. ESET said the malware gave operators broad post-compromise access, including host fingerprinting, file and registry manipulation, process execution, and the ability to load additional payloads.
Aug 14, 2026
ESET attributed a targeted supply-chain attack to **OceanLotus** (`APT32`), saying the Vietnam-aligned espionage group compromised the update server for **FireAnt MetaKit**, a software component used by Vietnamese stock investors, and pushed malicious updates between October 2025 and March 2026. The tampered updates delivered a downloader that used DLL side-loading to install the **SPECTRALVIPER** backdoor, with researchers saying the operation was selective rather than a broad mass infection campaign. FireAnt MetaKit’s update process reportedly lacked integrity checks and TLS protection, allowing attackers to replace legitimate packages and abuse the trusted update channel. Researchers said the malware used HTTPS for command-and-control, injected into `OneDrive.Sync.Service.exe`, and relied on infrastructure including `financemachinelearning[.]com`, while a parallel OceanLotus intrusion hit an unnamed Vietnamese infrastructure and transport construction company after suspected exploitation of remote code execution flaws in a public-facing Microsoft SQL Server. Multiple SPECTRALVIPER variants were then used for persistence, profiling, and lateral movement. The campaigns indicate a sharper OceanLotus focus on domestic Vietnamese surveillance, including targets tied to finance, infrastructure, and potentially politically sensitive anti-corruption and market investigations.
Jun 29, 2026