APT32

Overview

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

Targets

Civil society · Dissidents · Government · Journalists · Private sector

Regions

Association of Southeast Asian Nations · China · Germany · Philippines · United States · Vietnam

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 10 attributed custom malware families

TTPs — 78 techniques across 14 tactics

Tools & malware (15)

Mimikatz · ipconfig · Kerrdown · Cobalt Strike · SOUNDBITE · OSX_OCEANLOTUS.D · KOMPROGO · netsh · RotaJakiro · PHOREAL · Arp · WINDSHIELD · Denis · Net · Goopy

Reporting (3)

• How Microsoft names threat actors — Microsoft
• Vietnamese activists targeted by notorious hacking group — Amnesty International
• Fake or Fake: Keeping up with OceanLotus decoys — Dumont, R