🇻🇳

APT32

APT Group Information theft and espionage 8 zero-day CVEs ETDA ✓

Also Known As 16 names

APT 32 APT-32 APT-C-00 ATK17 BISMUTH Canvas Cyclone Cobalt Kitty G0050 Ocean Buffalo Ocean Lotus OceanLotus OceanLotus Group POND LOACH Sea Lotus SeaLotus TIN WOODLAWN

Target Countries 20

Countries highlighted in red

Australia Bangladesh China Germany Denmark Indonesia India Islamic Republic of Iran Japan Cambodia Republic of Korea Myanmar Malaysia Netherlands Nepal Philippines Singapore Thailand United States Vietnam

Sectors Targeted

Telecommunications Retail Government High-Tech Uyghurs, dissidents and journalists Financial Media Manufacturing Hospitality Defense

Details

Origin 🇻🇳 VN

Last Updated 01 Jun 2022

Malware Families 10

metaljack

cactustorch

cuegoe

remy

zhmimikatz

phantomlance

ratsnif

strikesuit_gift

caja

salgorea

MITRE ATT&CK 180

T1001 - Data Obfuscation T1003 - OS Credential Dumping T1003.001 T1005 - Data from Local System T1007 - System Service Discovery T1008 - Fallback Channels T1011 - Exfiltration Over Other Network Medium T1012 - Query Registry T1014 - Rootkit T1016 - System Network Configuration Discovery T1018 - Remote System Discovery T1021 - Remote Services T1021.002 T1027 - Obfuscated Files or Information T1027.001 T1027.010 T1027.011 T1027.013 T1027.016 T1029 - Scheduled Transfer T1030 - Data Transfer Size Limits T1033 - System Owner/User Discovery T1036 - Masquerading T1036.003 T1036.004 T1036.005 - Match Legitimate Name or Location T1041 - Exfiltration Over C2 Channel T1046 - Network Service Scanning T1047 - Windows Management Instrumentation T1048 - Exfiltration Over Alternative Protocol T1048.003 T1049 - System Network Connections Discovery T1053 - Scheduled Task/Job T1053.005 - Scheduled Task T1055 - Process Injection T1056 - Input Capture T1056.001 - Keylogging T1057 - Process Discovery T1059 - Command and Scripting Interpreter T1059.001 - PowerShell T1059.003 - Windows Command Shell T1059.005 T1059.007 T1060 - Registry Run Keys / Startup Folder T1068 - Exploitation for Privilege Escalation T1069 - Permission Groups Discovery T1070 - Indicator Removal on Host T1070.001 T1070.004 T1070.006 T1071 - Application Layer Protocol T1071.001 - Web Protocols T1071.003 T1072 T1078 - Valid Accounts T1078.003 T1081 - Credentials in Files T1082 - System Information Discovery T1083 - File and Directory Discovery T1085 - Rundll32 T1087 - Account Discovery T1087.001 T1090 - Proxy T1095 - Non-Application Layer Protocol T1102 - Web Service T1105 - Ingress Tool Transfer T1106 - Native API T1110 - Brute Force T1112 - Modify Registry T1113 - Screen Capture T1114 - Email Collection T1114.001 - Local Email Collection T1115 - Clipboard Data T1119 - Automated Collection T1120 - Peripheral Device Discovery T1123 - Audio Capture T1124 - System Time Discovery T1127 - Trusted Developer Utilities Proxy Execution T1129 - Shared Modules T1130 - Install Root Certificate T1132 - Data Encoding T1133 - External Remote Services T1134 - Access Token Manipulation T1135 - Network Share Discovery T1136 - Create Account T1137 - Office Application Startup T1140 - Deobfuscate/Decode Files or Information T1170 - Mshta T1176 - Browser Extensions T1185 - Man in the Browser T1187 - Forced Authentication T1189 T1190 - Exploit Public-Facing Application T1195 - Supply Chain Compromise T1199 - Trusted Relationship T1203 T1204 - User Execution T1204.001 T1204.002 - Malicious File T1216 T1216.001 T1217 - Browser Bookmark Discovery T1218 - Signed Binary Proxy Execution T1218.005 T1218.007 - Msiexec T1218.010 T1218.011 T1222 T1222.002 T1485 - Data Destruction T1486 - Data Encrypted for Impact T1489 - Service Stop T1490 - Inhibit System Recovery T1496 - Resource Hijacking T1497 - Virtualization/Sandbox Evasion T1497.003 - Time Based Evasion T1498 - Network Denial of Service T1503 - Credentials from Web Browsers T1505 T1505.003 T1518 - Software Discovery T1525 - Implant Internal Image T1529 - System Shutdown/Reboot T1530 - Data from Cloud Storage Object T1531 - Account Access Removal T1539 - Steal Web Session Cookie T1543 - Create or Modify System Process T1543.003 T1546 - Event Triggered Execution T1547 - Boot or Logon Autostart Execution T1547.001 - Registry Run Keys / Startup Folder T1548 - Abuse Elevation Control Mechanism T1550 - Use Alternate Authentication Material T1550.002 T1550.003 T1552 - Unsecured Credentials T1552.002 T1553 - Subvert Trust Controls T1555 - Credentials from Password Stores T1559 - Inter-Process Communication T1560 - Archive Collected Data T1561 - Disk Wipe T1562 - Impair Defenses T1562.001 - Disable or Modify Tools T1564 - Hide Artifacts T1564.001 T1564.003 T1564.004 T1566 - Phishing T1566.001 T1566.002 T1568 - Dynamic Resolution T1569 T1569.002 T1570 T1571 - Non-Standard Port T1573 - Encrypted Channel T1574 - Hijack Execution Flow T1574.001 T1574.002 - DLL Side-Loading T1583 - Acquire Infrastructure T1583.001 T1583.006 T1585 T1585.001 T1587 - Develop Capabilities T1588 T1588.002 T1588.006 - Vulnerabilities T1589 T1589.002 T1595 - Active Scanning T1595.002 - Vulnerability Scanning T1598 T1598.003 T1608 T1608.001 T1608.004 T1685 T1685.005

Related Zero-Days 8

CVE-2018-8174 CVE-2020-1472 CVE-2021-1675 CVE-2021-34527 CVE-2022-26138 CVE-2022-42475 CVE-2023-36884 CVE-2023-38831

Known Names 12 entries

APT 32 Mandiant

OceanLotus SkyEye Labs

SeaLotus ?

APT-C-00 Qihoo 360

Ocean Buffalo CrowdStrike

Tin Woodlawn SecureWorks

ATK 17 Thales

SectorF01 ThreatRecon

Pond Loach Accenture

APT-LY-100 ?

Lotus Bane Group-IB

G0050 MITRE

Observed Target Countries 24

Based on ETDA data — countries highlighted in red

ASEAN Australia Bangladesh Brunei Cambodia China Denmark Germany India Indonesia Iran Japan Laos Malaysia Myanmar Nepal Netherlands Philippines Singapore South Korea Thailand UK USA Vietnam

Description

(FireEye) Since at least 2014, FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. Furthermore, there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations. In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013.

Tools Used 29

AtNow CACTUSTORCH CamCapture Plugin Cobalt Strike Cuegoe DKMC fingerprintjs2 Goopy HiddenLotus KerrDown KOMPROGO METALJACK Mimikatz MSFvenom Nishang OceanLotus Pagoda PhantomLance PHOREAL PowerSploit QuasarRAT RatSnif Remy Roland Salgorea SOUNDBITE Terracotta VPN Veil 0-day exploits in MS Office

Operations 26

2014-04 Operation “PhantomLance” In July 2019, Dr. Web reported about a backdoor trojan in Google Play, which appeared to be sophisticated and unlike common malware often uploaded for stealing victims’ money or displaying ads. So, we conducted an inquiry of our own, discovering a long-term campaign, which we dubbed “PhantomLance”, its earliest registered domain dating back to December 2015. https://securelist.com/apt-phantomlance/96772/ https://labs.bitdefender.com/2020/05/android-campaign-from-known-oceanlotus-apt-group-potentially-older-than-estimated-abused-legitimate-certificate/

2014-12 These applications disguise as a normal application, and their icons will hide automatically after they are running. They will release malicious sub-packages in the background, receive the remote control command, steal the privacy information of users such as SMS messages, contacts, call records, geographic locations, and browser records. They also download apks secretly and record audios and videos, then upload users’ privacy information to server, causing users’ privacy leakage. https://www.antiy.net/p/analysis-of-the-attack-of-mobile-devices-by-oceanlotus/

2015-08 Terracotta VPN Dubbed by RSA as “Terracotta VPN” (a reference to the Chinese Terracotta Army), this satellite array of VPN services “may represent the first exposure of a PRC-based VPN operation that maliciously, efficiently and rapidly enlists vulnerable servers around the world,” the company said in a report released today. https://krebsonsecurity.com/2015/08/chinese-vpn-service-as-attack-platform/

2016-09 Blackberry Cylance threat researchers have analyzed the Ratsnif rojans, which offer a veritable swiss-army knife of network attack techniques. The rojans, under active development since 2016, combine capabilities like packet sniffing, gateway/device ARP poisoning, DNS poisoning, HTTP injection, and MAC spoofing. https://threatvector.cylance.com/en_us/home/threat-spotlight-ratsnif-new-network-vermin-from-oceanlotus.html

2017-03 Breach of the ASEAN website Steven Adair, founder and CEO, said the hacking group was still active, and had compromised the website of the Association of South East Asian Nations (ASEAN) over several high-profile summit meetings. ASEAN is holding another summit of regional leaders in the Philippines capital Manila this week. https://www.reuters.com/article/us-cyber-attack-vietnam/vietnams-neighbors-asean-targeted-by-hackers-report-idUSKBN1D70VU

2017-05 Operation “Cobalt Kitty” Dubbed Operation Cobalt Kitty, the APT targeted a global corporation based in Asia with the goal of stealing proprietary business information. The threat actor targeted the company’s top-level management by using spear-phishing attacks as the initial penetration vector, ultimately compromising the computers of vice presidents, senior directors and other key personnel in the operational departments. During Operation Cobalt Kitty, the attackers compromised more than 40 PCs and servers, including the domain controller, file servers, Web application server and database server. https://www.cybereason.com/blog/operation-cobalt-kitty-apt

2017-05 Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society In May 2017, Volexity identified and started tracking a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting several Asian nations, the ASEAN organization, and hundreds of individuals and organizations tied to media, human rights and civil society causes. These attacks are being conducted through numerous strategically compromised websites and have occurred over several high-profile ASEAN summits. https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/

2017-10 During an incident response investigation in the final quarter of 2017, Cylance incident responders and threat researchers uncovered several bespoke backdoors deployed by OceanLotus Group (a.k.a. APT32, Cobalt Kitty), as well as evidence of the threat actor using obfuscated CobaltStrike Beacon payloads to perform C2. https://threatvector.cylance.com/en_us/home/report-the-spyrats-of-oceanlotus.html

2018 Early KerrDown downloader We identified two methods to deliver the KerrDown downloader to targets. One is using the Microsoft Office Document with a malicious macro and the other is RAR archive which contains a legitimate program with DLL side-loading. For RAR archive files, the file names used to trick targets are all in Vietnamese as shown in Figure 11. Our analysis shows that the primary targets of the ongoing campaign discussed in this blog are either in Vietnam or Vietnamese speaking individuals. https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/

2018-03 OceanLotus ships new backdoor using old tricks https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/

2018-04 New MacOS Backdoor The MacOS backdoor was found in a malicious Word document presumably distributed via email. The document bears the filename “2018-PHIẾU GHI DANH THAM DỰ TĨNH HỘI HMDC 2018.doc,” which translates to “2018-REGISTRATION FORM OF HMDC ASSEMBLY 2018.doc.” The document claims to be a registration form for an event with HDMC, an organization in Vietnam that advertises national independence and democracy. https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/

2018-04 Steganography to Shroud Payloads The OceanLotus APT is using two new loaders which use steganography to read their encrypted payloads. https://threatpost.com/oceanlotus-apt-uses-steganography-to-shroud-payloads/143373/

2018-05 Watering Hole Attack using the Phnom Penh Post website The attack started just days after Australian mining magnate Bill Clough sold the newspaper to Malaysian spin doctor Sivakumar Ganapathy, who specializes in “covert PR”. “Since last Tuesday [May 8], computers in our office were targeted by a malicious piece of code when we visited the Phnom Penh Post website,” said Naly Pilorge, director of Licadho — one of Cambodia’s leading human rights groups. https://www.abc.net.au/news/2018-05-15/hackers-trigger-software-trap-after-phnom-penh-post-sale/9763906

2018 Mid Equation Editor exploit In mid-2018, OceanLotus carried out a campaign using documents abusing the weakness exposed by the CVE-2017-11882 vulnerability. Indeed, several Proofs-of-Concept were made available. The vulnerability resides in the component responsible for rendering and editing mathematical equations. https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/

2018-09 Watering Hole Attack in Southeast Asia ESET researchers have discovered a new watering hole campaign targeting several websites in Southeast Asia, and that is believed to have been active since September 2018. This campaign stands out because of its large scale, as we were able to identify 21 compromised websites, some of which are particularly notable. Among the compromised websites were the Ministry of Defense of Cambodia, the Ministry of Foreign Affairs and International Cooperation of Cambodia and several Vietnamese newspaper or blog websites. https://www.welivesecurity.com/2018/11/20/oceanlotus-new-watering-hole-attack-southeast-asia/

2019-01 Self-Extracting archives After using RTF files, the group started using self-extracting (SFX) archives that use common document icons in an attempt to further mislead their victims. It was briefly documented by Threatbook (in Chinese). When run, these self-extracting RAR files drop and execute DLL files (with a .ocx extension) with the final payload being the previously documented {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll. Since the middle of January 2019, OceanLotus began reusing the technique but changed some configuration over time.

2019-03 macOS malware update Early in March 2019, a new macOS malware sample from the OceanLotus group was uploaded to VirusTotal, a popular online multi-scanner service. This backdoor executable bears the same features as the previous macOS variant we looked at, but its structure has changed and its detection was made harder. Unfortunately, we couldn’t find the dropper associated with this sample so we do not know the initial compromise vector. https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/

2019-03 Malicious macro armed documents likely targeting ASEAN affairs and meeting members. Telemetry and spreading statistics related to these decoy documents highlight their diffusion in the geographical area of Thailand. https://brica.de/alerts/alert/public/1258637/oceanlotus-on-asean-affairs/

2019-03 Breach of Toyota in Australia, Japan, Thailand and Vietnam Toyota said the servers that hackers accessed stored sales information on up to 3.1 million customers. The carmaker said there’s an ongoing investigation to find out if hackers exfiltrated any of the data they had access to. https://www.zdnet.com/article/toyota-announces-second-security-breach-in-the-last-five-weeks/

2019-05 Attacks to Indochinese Peninsula In this report, we share our summary of the latest attack techniques, attack payloads and related attacks of the OceanLotus, hoping that we can jointly improve understanding of OceanLotus group, an extremely active APT group. https://ti.qianxin.com/blog/articles/oceanlotus-attacks-to-indochinese-peninsula-evolution-of-targets-techniques-and-procedure/

2019-12 Breach of BMW and Hyundai https://www.zdnet.com/article/bmw-and-hyundai-hacked-by-vietnamese-hackers-report-claims/

2020-01 Vietnamese Threat Actors APT32 Targeting Wuhan Government and Chinese Ministry of Emergency Management in Latest Example of COVID-19 Related Espionage https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html

2020 Throughout the year, Volexity identified multiple Vietnamese-language news websites that appeared to be compromised, as they were being used to load an OceanLotus web profiling framework. https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/

2020-07 New APT32 Malware Campaign Targets Cambodian Government https://www.recordedfuture.com/apt32-malware-campaign/

2020-11 New MacOS Backdoor Connected to OceanLotus Surfaces https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html

2024-08 Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders

Reports & References 5

https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html https://www.welivesecurity.com/wp-content/uploads/2018/03/ESET_OceanLotus.pdf https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/SpyRATsofOceanLotusMalwareWhitePaper.pdf https://www.riskiq.com/blog/analyst/oceanlotus/ https://github.com/eset/malware-research/tree/master/oceanlotus

ETDA Profile

APT 32, OceanLotus, SeaLotus

Origin

Vietnam

First Seen 2013

Sponsor State-sponsored

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0050/

View on ETDA APT Groups ↗