APT32

Introduction

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. FireEye APT32 May 2017 Volexity OceanLotus Nov 2017 ESET OceanLotus

Activities and Tactics

Targeted Sectors: Government, Media, Technology, Dissidents, Government, Administration, Journalist, Private sector, Civil society

Country of Origin: 🇻🇳 Vietnam

Risk Level: High

First Seen: 2012

Last Activity: 2024

Incident Type: Espionage

Suspected Victims: China, Germany, United States, Vietnam, Philippines, Association of Southeast Asian Nations

Notable Campaigns

• 2014-04
• 2014-12
• 2015-08
• 2016-09
• 2017-03
• 2017-05
• 2017-10
• 2018 Early
• 2018 Mid
• 2018-03
• 2018-04
• 2018-05
• 2018-09
• 2019-01
• 2019-03
• 2019-05
• 2019-12
• 2020
• 2020-01
• 2020-07
• 2020-11
• 2024-08
• Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders
• After using RTF files
• Asian Nations
• Attacks to Indochinese Peninsula
• Blackberry Cylance threat researchers have analyzed the Ratsnif rojans
• Breach of BMW and Hyundai
• Breach of Toyota in Australia
• Breach of the ASEAN website
• Cobalt Kitty)
• Cylance incident responders and threat researchers uncovered several bespoke backdoors deployed by OceanLotus Group (a.k.a. APT32
• DNS poisoning
• Dr. Web reported about a backdoor trojan in Google Play
• Dubbed Operation Cobalt Kitty
• Dubbed by RSA as “Terracotta VPN” (a reference to the Chinese Terracotta Army)
• During an incident response investigation in the final quarter of 2017
• ESET researchers have discovered a new watering hole campaign targeting several websites in Southeast Asia
• Early in March 2019
• Equation Editor exploit
• HTTP injection
• Human Rights Groups
• In July 2019
• In May 2017
• In mid-2018
• In this report
• Japan
• KerrDown downloader
• Malicious macro armed documents likely targeting ASEAN affairs and meeting members. Telemetry and spreading statistics related to these decoy documents highlight their diffusion in the geographical area of Thailand.
• Mass Digital Surveillance and Attacks Targeting ASEAN
• New APT32 Malware Campaign Targets Cambodian Government
• New MacOS Backdoor
• New MacOS Backdoor Connected to OceanLotus Surfaces
• OceanLotus began reusing the technique but changed some configuration over time.
• OceanLotus carried out a campaign using documents abusing the weakness exposed by the CVE-2017-11882 vulnerability. Indeed
• OceanLotus ships new backdoor using old tricks
• Operation “Cobalt Kitty”
• Operation “PhantomLance”
• Self-Extracting archives
• Steganography to Shroud Payloads
• Steven Adair
• Terracotta VPN
• Thailand and Vietnam
• The MacOS backdoor was found in a malicious Word document presumably distributed via email. The document bears the filename “2018-PHIẾU GHI DANH THAM DỰ TĨNH HỘI HMDC 2018.doc
• The OceanLotus APT is using two new loaders which use steganography to read their encrypted payloads.
• The attack started just days after Australian mining magnate Bill Clough sold the newspaper to Malaysian spin doctor Sivakumar Ganapathy
• These applications disguise as a normal application
• Throughout the year
• Toyota said the servers that hackers accessed stored sales information on up to 3.1 million customers. The carmaker said there’s an ongoing investigation to find out if hackers exfiltrated any of the data they had access to.
• Vietnamese Threat Actors APT32 Targeting Wuhan Government and Chinese Ministry of Emergency Management in Latest Example of COVID-19 Related Espionage
• Volexity identified and started tracking a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting several Asian nations
• Volexity identified multiple Vietnamese-language news websites that appeared to be compromised
• Watering Hole Attack in Southeast Asia
• Watering Hole Attack using the Phnom Penh Post website
• We identified two methods to deliver the KerrDown downloader to targets. One is using the Microsoft Office Document with a malicious macro and the other is RAR archive which contains a legitimate program with DLL side-loading. For RAR archive files
• Web application server and database server.
• a new macOS malware sample from the OceanLotus group was uploaded to VirusTotal
• a popular online multi-scanner service. This backdoor executable bears the same features as the previous macOS variant we looked at
• an extremely active APT group.
• an organization in Vietnam that advertises national independence and democracy.
• and Civil Society
• and MAC spoofing.
• and browser records. They also download apks secretly and record audios and videos
• and had compromised the website of the Association of South East Asian Nations (ASEAN) over several high-profile summit meetings. ASEAN is holding another summit of regional leaders in the Philippines capital Manila this week.
• and hundreds of individuals and organizations tied to media
• and that is believed to have been active since September 2018. This campaign stands out because of its large scale
• and their icons will hide automatically after they are running. They will release malicious sub-packages in the background
• as they were being used to load an OceanLotus web profiling framework.
• as we were able to identify 21 compromised websites
• as well as evidence of the threat actor using obfuscated CobaltStrike Beacon payloads to perform C2.
• attack payloads and related attacks of the OceanLotus
• but its structure has changed and its detection was made harder. Unfortunately
• call records
• causing users’ privacy leakage.
• combine capabilities like packet sniffing
• computers in our office were targeted by a malicious piece of code when we visited the Phnom Penh Post website
• contacts
• director of Licadho — one of Cambodia’s leading human rights groups.
• discovering a long-term campaign
• efficiently and rapidly enlists vulnerable servers around the world
• file servers
• founder and CEO
• gateway/device ARP poisoning
• geographic locations
• hoping that we can jointly improve understanding of OceanLotus group
• https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/
• https://brica.de/alerts/alert/public/1258637/oceanlotus-on-asean-affairs/
• https://krebsonsecurity.com/2015/08/chinese-vpn-service-as-attack-platform/
• https://labs.bitdefender.com/2020/05/android-campaign-from-known-oceanlotus-apt-group-potentially-older-than-estimated-abused-legitimate-certificate/
• https://securelist.com/apt-phantomlance/96772/
• https://threatpost.com/oceanlotus-apt-uses-steganography-to-shroud-payloads/143373/
• https://threatvector.cylance.com/en_us/home/report-the-spyrats-of-oceanlotus.html
• https://threatvector.cylance.com/en_us/home/threat-spotlight-ratsnif-new-network-vermin-from-oceanlotus.html
• https://ti.qianxin.com/blog/articles/oceanlotus-attacks-to-indochinese-peninsula-evolution-of-targets-techniques-and-procedure/
• https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/
• https://www.abc.net.au/news/2018-05-15/hackers-trigger-software-trap-after-phnom-penh-post-sale/9763906
• https://www.antiy.net/p/analysis-of-the-attack-of-mobile-devices-by-oceanlotus/
• https://www.cybereason.com/blog/operation-cobalt-kitty-apt
• https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html
• https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders
• https://www.recordedfuture.com/apt32-malware-campaign/
• https://www.reuters.com/article/us-cyber-attack-vietnam/vietnams-neighbors-asean-targeted-by-hackers-report-idUSKBN1D70VU
• https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
• https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/
• https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/
• https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/
• https://www.welivesecurity.com/2018/11/20/oceanlotus-new-watering-hole-attack-southeast-asia/
• https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
• https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
• https://www.zdnet.com/article/bmw-and-hyundai-hacked-by-vietnamese-hackers-report-claims/
• https://www.zdnet.com/article/toyota-announces-second-security-breach-in-the-last-five-weeks/
• human rights and civil society causes. These attacks are being conducted through numerous strategically compromised websites and have occurred over several high-profile ASEAN summits.
• including the domain controller
• its earliest registered domain dating back to December 2015.
• macOS malware update
• receive the remote control command
• said the hacking group was still active
• senior directors and other key personnel in the operational departments. During Operation Cobalt Kitty
• several Proofs-of-Concept were made available. The vulnerability resides in the component responsible for rendering and editing mathematical equations.
• some of which are particularly notable. Among the compromised websites were the Ministry of Defense of Cambodia
• steal the privacy information of users such as SMS messages
• the APT targeted a global corporation based in Asia with the goal of stealing proprietary business information. The threat actor targeted the company’s top-level management by using spear-phishing attacks as the initial penetration vector
• the ASEAN organization
• the Media
• the Ministry of Foreign Affairs and International Cooperation of Cambodia and several Vietnamese newspaper or blog websites.
• the attackers compromised more than 40 PCs and servers
• the file names used to trick targets are all in Vietnamese as shown in Figure 11. Our analysis shows that the primary targets of the ongoing campaign discussed in this blog are either in Vietnam or Vietnamese speaking individuals.
• the group started using self-extracting (SFX) archives that use common document icons in an attempt to further mislead their victims. It was briefly documented by Threatbook (in Chinese). When run
• then upload users’ privacy information to server
• these self-extracting RAR files drop and execute DLL files (with a .ocx extension) with the final payload being the previously documented {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll. Since the middle of January 2019
• this satellite array of VPN services “may represent the first exposure of a PRC-based VPN operation that maliciously
• ultimately compromising the computers of vice presidents
• under active development since 2016
• we conducted an inquiry of our own
• we couldn’t find the dropper associated with this sample so we do not know the initial compromise vector.
• we share our summary of the latest attack techniques
• which appeared to be sophisticated and unlike common malware often uploaded for stealing victims’ money or displaying ads. So
• which offer a veritable swiss-army knife of network attack techniques. The rojans
• which we dubbed “PhantomLance”
• who specializes in “covert PR”.
• “Since last Tuesday [May 8]
• ” said Naly Pilorge
• ” the company said in a report released today.
• ” which translates to “2018-REGISTRATION FORM OF HMDC ASSEMBLY 2018.doc.” The document claims to be a registration form for an event with HDMC

Tactics, Techniques, and Procedures (TTPs)

• T1550.002 Pass the Hash
• T1036 Masquerading
• T1059.007 JavaScript
• T1047 Windows Management Instrumentation
• T1072 Software Deployment Tools
• T1570 Lateral Tool Transfer
• T1564.004 NTFS File Attributes
• T1552.002 Credentials in Registry
• T1055 Process Injection
• T1216.001 PubPrn
• T1566.001 Spearphishing Attachment
• T1135 Network Share Discovery
• T1033 System Owner/User Discovery
• T1571 Non-Standard Port
• T1082 System Information Discovery
• T1583.001 Domains
• T1012 Query Registry
• T1027.010 Command Obfuscation
• T1059.003 Windows Command Shell
• T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
• T1574.001 DLL
• T1566.002 Spearphishing Link
• T1598.003 Spearphishing Link
• T1087.001 Local Account
• T1059.001 PowerShell
• T1003.001 LSASS Memory
• T1046 Network Service Discovery
• T1608.004 Drive-by Target
• T1041 Exfiltration Over C2 Channel
• T1036.004 Masquerade Task or Service
• T1003 OS Credential Dumping
• T1078.003 Local Accounts
• T1589 Gather Victim Identity Information
• T1070.006 Timestomp
• T1189 Drive-by Compromise
• T1218.011 Rundll32
• T1059 Command and Scripting Interpreter
• T1112 Modify Registry
• T1071.003 Mail Protocols
• T1560 Archive Collected Data
• T1204.001 Malicious Link
• T1071.001 Web Protocols
• T1036.005 Match Legitimate Resource Name or Location
• T1070.004 File Deletion
• T1027.011 Fileless Storage
• T1105 Ingress Tool Transfer
• T1053.005 Scheduled Task
• T1036.003 Rename Legitimate Utilities
• T1543.003 Windows Service
• T1608.001 Upload Malware
• T1222.002 Linux and Mac Permissions
• T1569.002 Service Execution
• T1018 Remote System Discovery
• T1218.005 Mshta
• T1083 File and Directory Discovery
• T1685.005 Clear Windows Event Logs
• T1059.005 Visual Basic
• T1588.002 Tool
• T1021.002 SMB/Windows Admin Shares
• T1550.003 Pass the Ticket
• T1583.006 Web Services
• T1505.003 Web Shell
• T1564.001 Hidden Files and Directories
• T1016 System Network Configuration Discovery
• T1027.016 Junk Code Insertion
• T1049 System Network Connections Discovery
• T1564.003 Hidden Window
• T1027.013 Encrypted/Encoded File
• T1056.001 Keylogging
• T1589.002 Email Addresses
• T1218.010 Regsvr32
• T1068 Exploitation for Privilege Escalation
• T1585.001 Social Media Accounts
• T1137 Office Application Startup
• T1203 Exploitation for Client Execution
• T1204.002 Malicious File
• T1547.001 Registry Run Keys / Startup Folder
• T1102 Web Service

ATT&CK technique IDs (denormalized)

• T1003
• T1003.001
• T1012
• T1016
• T1018
• T1021.002
• T1027.010
• T1027.011
• T1027.013
• T1027.016
• T1033
• T1036
• T1036.003
• T1036.004
• T1036.005
• T1041
• T1046
• T1047
• T1048.003
• T1049
• T1053.005
• T1055
• T1056.001
• T1059
• T1059.001
• T1059.003
• T1059.005
• T1059.007
• T1068
• T1070.004
• T1070.006
• T1071.001
• T1071.003
• T1072
• T1078.003
• T1082
• T1083
• T1087.001
• T1102
• T1105
• T1112
• T1135
• T1137
• T1189
• T1203
• T1204.001
• T1204.002
• T1216.001
• T1218.005
• T1218.010
• T1218.011
• T1222.002
• T1505.003
• T1543.003
• T1547.001
• T1550.002
• T1550.003
• T1552.002
• T1560
• T1564.001
• T1564.003
• T1564.004
• T1566.001
• T1566.002
• T1569.002
• T1570
• T1571
• T1574.001
• T1583.001
• T1583.006
• T1585.001
• T1588.002
• T1589
• T1589.002
• T1598.003
• T1608.001
• T1608.004
• T1685.005

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 3 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• CyberGate
• Cyber Eye RAT
• CrossRat
• 0-day exploits in MS Office:
• AtNow:
• CACTUSTORCH:
• CamCapture Plugin:
• Cobalt Strike:
• Cuegoe:
• DKMC:
• Goopy:
• HiddenLotus:
• KOMPROGO:
• KerrDown:
• METALJACK:
• MSFvenom:
• Mimikatz:
• Nishang:
• OceanLotus:
• PHOREAL:
• Pagoda:
• PhantomLance:
• PowerSploit:
• QuasarRAT:
• RatSnif:
• Remy:
• Roland:
• SOUNDBITE:
• Salgorea:
• Terracotta VPN:
• Veil:
• fingerprintjs2:

MITRE ATT&CK Software

• Mimikatz (S0002) — tool
• ipconfig (S0100) — tool
• Kerrdown (S0585) — malware
• Cobalt Strike (S0154) — malware
• SOUNDBITE (S0157) — malware
• OSX_OCEANLOTUS.D (S0352) — malware
• KOMPROGO (S0156) — malware
• netsh (S0108) — tool
• RotaJakiro (S1078) — malware
• PHOREAL (S0158) — malware
• Arp (S0099) — tool
• WINDSHIELD (S0155) — malware
• Denis (S0354) — malware
• Net (S0039) — tool
• Goopy (S0477) — malware

Attribution and Evidence

Country of Origin: Vietnam Additional attribution information pending cataloguing.

References

[1] mitre-attack [8] Amnesty Intl. Ocean Lotus February 2021 Amnesty International. (2021, February 24). Vietnamese activists targeted by notorious hacking group. Retrieved March 1, 2021. [9] FireEye APT32 May 2017 Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017. [10] Cybereason Oceanlotus May 2017 Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018. [11] ESET OceanLotus Mar 2019 Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019. [12] ESET OceanLotus Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018. [13] Volexity OceanLotus Nov 2017 Lassalle, D., et al. (2017, November 6). OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society. Retrieved November 6, 2017. [14] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.