APT32
- ID
- G0050
- Associated names
- SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]
Techniques used (78)
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1012 Query Registry
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1027.010 Command Obfuscation
- T1027.011 Fileless Storage
- T1027.013 Encrypted/Encoded File
- T1027.016 Junk Code Insertion
- T1033 System Owner/User Discovery
- T1036 Masquerading
- T1036.003 Rename Legitimate Utilities
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1055 Process Injection
- T1056.001 Keylogging
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1070.006 Timestomp
- T1071.001 Web Protocols
- T1071.003 Mail Protocols
- T1072 Software Deployment Tools
- T1078.003 Local Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087.001 Local Account
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1135 Network Share Discovery
- T1137 Office Application Startup
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1216.001 PubPrn
- T1218.005 Mshta
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1222.002 Linux and Mac Permissions
- T1505.003 Web Shell
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1550.002 Pass the Hash
- T1550.003 Pass the Ticket
- T1552.002 Credentials in Registry
- T1560 Archive Collected Data
- T1564.001 Hidden Files and Directories
- T1564.003 Hidden Window
- T1564.004 NTFS File Attributes
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
- T1571 Non-Standard Port
- T1574.001 DLL
- T1583.001 Domains
- T1583.006 Web Services
- T1585.001 Social Media Accounts
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1589.002 Email Addresses
- T1598.003 Spearphishing Link
- T1608.001 Upload Malware
- T1608.004 Drive-by Target
- T1685.005 Clear Windows Event Logs
Software used (15)
- S0002 Mimikatz
- S0039 Net
- S0099 Arp
- S0100 ipconfig
- S0108 netsh
- S0154 Cobalt Strike
- S0155 WINDSHIELD
- S0156 KOMPROGO
- S0157 SOUNDBITE
- S0158 PHOREAL
- S0352 OSX_OCEANLOTUS.D
- S0354 Denis
- S0477 Goopy
- S0585 Kerrdown
- S1078 RotaJakiro