Skip to main content
Mallory
Vietnam29 malware familiesExploits CVEs in the wild

APT32

Also known asAPT-C-00APT32ATK 17BISMUTHCanvas CycloneCobalt KittyG0050Lotus BaneOCEAN BUFFALOOcean Lotusoceanlotusoceanlotus_groupPond LoachSeaLotusSectorF01Tin Woodlawn

APT32, also known as OceanLotus, Ocean Lotus, APT-C-00, BISMUTH, Cobalt Kitty, Canvas Cyclone, Lotus Bane, Ocean Buffalo, Pond Loach, SeaLotus, SectorF01, and TIN Woodlawn, is a Vietnam-aligned cyberespionage threat actor whose operations are described as aligned with the interests of the Vietnamese government. Reporting in the provided content states the group has been active since at least 2012, with Amnesty International noting activity since at least 2014. The group has targeted Vietnamese human rights defenders and civil society, the private sector, domestic Vietnamese entities, stock investors, foreign governments including Laos and Cambodia, NGOs, news agencies, and businesses across sectors including information technology, hospitality, agriculture and commodities, hospitals, retail, automotive, and mobile services. The content describes APT32 using spearphishing attachments to lure users into executing a malicious dropper, hosting payloads on Dropbox, Amazon S3, and Google Drive, and using JavaScript over HTTP or HTTPS to attacker-controlled domains to download additional frameworks and encrypted payloads. It has used COM scriptlets to download Cobalt Strike beacons, heavily obfuscated PowerShell including the WindowStyle parameter to hide execution, Invoke-Obfuscation, and regsvr32.exe "Squiblydoo" to retrieve second-stage payloads. For persistence, APT32 modified Windows Services to ensure PowerShell scripts were loaded and created a Windows service; it also used Registry Run keys to execute PowerShell, VBS scripts, and its backdoor directly. The group has used WMI to deploy tools on remote machines and gather information about the Outlook process. Observed discovery behavior includes listing files and directories, collecting victim usernames, executing whoami, gathering IP configuration with ipconfig /all, and using shellcode to collect usernames. The content also notes a macOS backdoor that hides a clientID file via chflags, and Amnesty International reported OceanLotus malware for both Windows and macOS. In the Amnesty-reported campaign, Windows infections used Kerrdown, described there as used exclusively by OceanLotus, to download additional spyware including Cobalt Strike, while the macOS malware allowed access to system information and supported file download, upload, execution, and command execution. Recent reporting in the provided content attributes two SPECTRALVIPER campaigns to OceanLotus/APT32. One targeted a Vietnamese infrastructure and transport construction corporation from late 2024 to February 2026, likely involving remote code execution vulnerabilities in Microsoft SQL Server and DLL side-loading. The second was a supply-chain attack from October 2025 to March 2026 against FireAnt MetaKit, a platform used by stock investors in Vietnam, in which the group abused the legitimate update URL to selectively deliver SPECTRALVIPER. The malware is described as supporting host reconnaissance, HTTPS-based command and control, orchestration, lateral movement via named pipes, and process injection, including execution in OneDrive.Sync.Service.exe. The reporting characterizes these campaigns as reflecting an increasing emphasis on domestic espionage inside Vietnam.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

57 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

14 of 15 tactics83 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1592×2
Gather Victim Host Information
TA0042
Resource Development
3 techniques
T1583
Acquire Infrastructure
T1583.001
Domains
T1587
Develop Capabilities
T1587.001
Malware
T1588
Obtain Capabilities
T1588.002
Tool
TA0001
Initial Access
4 techniques
T1189×4
Drive-by Compromise
T1190
Exploit Public-Facing Application
T1195×3
Supply Chain Compromise
T1195.002×2
Compromise Software Supply Chain
T1566
Phishing
T1566.001×3
Spearphishing Attachment
T1566.002
Spearphishing Link
TA0002
Execution
7 techniques
T1047
Windows Management Instrumentation
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1059×4
Command and Scripting Interpreter
T1059.001×2
PowerShell
T1059.003×3
Windows Command Shell
T1059.005
Visual Basic
T1059.007
JavaScript
T1203×2
Exploitation for Client Execution
T1204×2
User Execution
T1204.002×3
Malicious File
T1559
Inter-Process Communication
T1559.001
Component Object Model
T1574
Hijack Execution Flow
T1574.001
DLL
TA0003
Persistence
4 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1112×2
Modify Registry
T1543
Create or Modify System Process
T1543.003
Windows Service
T1547
Boot or Logon Autostart Execution
T1547.001×2
Registry Run Keys / Startup Folder
TA0004
Privilege Escalation
4 techniques
T1053
Scheduled Task/Job
T1053.005
Scheduled Task
T1055×3
Process Injection
T1543
Create or Modify System Process
T1543.003
Windows Service
T1547
Boot or Logon Autostart Execution
T1547.001×2
Registry Run Keys / Startup Folder
TA0005
Stealth
8 techniques
T1027×4
Obfuscated Files or Information
T1027.013
Encrypted/Encoded File
T1036×4
Masquerading
T1055×3
Process Injection
T1070
Indicator Removal
T1070.004×2
File Deletion
T1070.006
Timestomp
T1218
System Binary Proxy Execution
T1218.010
Regsvr32
T1497
Virtualization/Sandbox Evasion
T1564
Hide Artifacts
T1564.001
Hidden Files and Directories
T1564.003
Hidden Window
T1574
Hijack Execution Flow
T1574.001
DLL
TA0112
Defense Impairment
2 techniques
T1112×2
Modify Registry
T1553
Subvert Trust Controls
T1553.002
Code Signing
TA0006
Credential Access
2 techniques
T1003
OS Credential Dumping
T1056
Input Capture
T1056.001
Keylogging
TA0007
Discovery
8 techniques
T1012×2
Query Registry
T1016
System Network Configuration Discovery
T1033
System Owner/User Discovery
T1057
Process Discovery
T1082×6
System Information Discovery
T1083
File and Directory Discovery
T1497
Virtualization/Sandbox Evasion
T1518
Software Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1570×2
Lateral Tool Transfer
TA0009
Collection
2 techniques
T1056
Input Capture
T1056.001
Keylogging
T1113
Screen Capture
TA0011
Command and Control
4 techniques
T1071
Application Layer Protocol
T1071.001×3
Web Protocols
T1105×3
Ingress Tool Transfer
T1132
Data Encoding
T1573
Encrypted Channel
TA0010
Exfiltration
1 technique
T1041×3
Exfiltration Over C2 Channel
IOCS

Observables

316 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

scworldNews
Jun 11, 2026
OceanLotus targets stock investors and construction firm with SPECTRALVIPER backdoor | brief | SC Media

Conducted two espionage-focused campaigns in Vietnam: one targeting a Vietnamese infrastructure and transport construction corporation, and another supply chain attack abusing FireAnt Metakit updates to deliver the SPECTRALVIPER backdoor to stock investors. The activity indicates a shift toward domestic espionage targets.

Read more
cyber security newsNews
Jun 11, 2026
OceanLotus APT Compromises FireAnt MetaKit in Supply-Chain Attack on Stock Investors

Conducted a supply chain attack against FireAnt MetaKit to selectively deliver the SPECTRALVIPER backdoor to stock investors in Vietnam, with apparent surveillance objectives tied to domestic financial investigations.

Read more
the hacker newsNews
Jun 11, 2026
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

Conducted cyber espionage campaigns targeting domestic Vietnamese entities and stock investors, including a supply chain attack via FireAnt Metakit and a prolonged intrusion into a Vietnamese infrastructure and transport construction corporation. The group is described as shifting toward domestic espionage while maintaining a history of targeting China and Vietnamese civil society, media, and dissidents.

Read more
eset welivesecurity blogNews
Jun 11, 2026
OceanLotus: From external espionage to domestic targeting

Cyberespionage group conducting selective external operations and increasing domestic espionage in Vietnam from 2024 to 2026, including a supply-chain attack via FireAnt MetaKit targeting stock investors and a prolonged intrusion into a Vietnamese infrastructure and transport construction company.

Read more
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping57

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal29

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs4

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables316

Domains, IPs, and hashes tied to this actor, refreshed continuously.