Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | OceanLotus Group |
| OSINT | Ocean Lotus |
| OSINT | OceanLotus |
| OSINT | Cobalt Kitty |
| OSINT | APT-C-00 |
| OSINT | SeaLotus |
| OSINT | Sea Lotus |
| OSINT | APT-32 |
| OSINT | Ocean Buffalo |
| OSINT | POND LOACH |
| OSINT | TIN WOODLAWN |
| OSINT | BISMUTH |
| OSINT | ATK17 |
| OSINT | G0050 |
| OSINT | Canvas Cyclone |
Sectors: Government, Private sector, Civil society, Dissidents, Government, Administration, Journalist
Victim countries: China, Germany, United States, Vietnam, Philippines, Association of Southeast Asian Nations
Top 45 by how many reports mention them.
Every report in the Global Intel Library that names APT32, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to APT32. Each row shows why it was linked and where it came from.
| Type | Indicator | Linked by | Seen | Source |
|---|---|---|---|---|
| domain | vitlescaux.com | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| hostname | libjss.inquirerjs.com | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| hostname | jcdn.jsoid.com | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| hostname | m.topiccore.com | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| hostname | libjs.inquirerjs.com | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| FileHash-MD5 | d739f10933c11bd6bd9677f91893986c | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| FileHash-MD5 | a4808a329b071a1a37b8d03b1305b0cb | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| FileHash-MD5 | c5b98b77810c5619d20b71791b820529 | OTX pulse "APT32 Targeting Chinese Government" | 2020-04-22 | AlienVault OTX |
| hostname | opengroup.homeunix.org | OTX pulse "APT32 Campaign Using Facebook and Dropbox to Deliver Malicious Document" | 2019-12-27 | AlienVault OTX |
| FileHash-SHA1 | 1f195339d91880c804c6041ec119cab05cd7c666 | OTX pulse "APT32 Campaign Using Facebook and Dropbox to Deliver Malicious Document" | 2019-12-27 | AlienVault OTX |
| FileHash-SHA1 | 22199d61c0c76ddb15f1c71505bfebb8b3279872 | OTX pulse "APT32 Campaign Using Facebook and Dropbox to Deliver Malicious Document" | 2019-12-27 | AlienVault OTX |
| FileHash-SHA1 | b10cf55ac9279d4d89602435a30b95c148a25d9f | OTX pulse "APT32 Campaign Using Facebook and Dropbox to Deliver Malicious Document" | 2019-12-27 | AlienVault OTX |
| URL | https://outlook.officebetas.com/templates/ | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| URL | https://outlook.officebetas.com/siss.png | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| URL | https://outlook.officebetas.com/Offices/template.png | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| URL | https://outlook.officebetas.com/vava.png | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| FileHash-SHA256 | bf4ac684ca1042f5b40a498dd0d1fabdfa6956ef7906bc21508ebd39ae5a79d3 | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| URL | https://outlook.officebetas.com/templates/vni-times.png | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| hostname | outlook.officebetas.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| FileHash-MD5 | cf0142da12509f544a59093495c3a6dd | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2019-04-02 | AlienVault OTX |
| domain | cdn-js.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | cloudflare-api.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | google-js.net | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | google-js.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | google-script.net | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | googlescripts.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | health-ray-id.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| domain | track-google.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | a.doulbeclick.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | ad.adthis.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | ad.jqueryclick.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | ad.linksys-analytic.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | ads.alternativeads.net | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | api.2nd-weibo.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | api.analyticsearch.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | api.baiduusercontent.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | api.disquscore.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | api.fbconnect.net | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | api.querycore.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | browser-extension.jdfkmiabjpfjacifcmihfdjhpnjpiick.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | cache.akamaihd-d.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | cdn.adsfly.co | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | cdn.disqusapi.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | cloud.corewidget.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | core.alternativeads.net | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | cory.ns.webjzcnd.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | d3.advertisingbaidu.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | eclick.analyticsearch.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | gs.baidustats.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | hit.asmung.net | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | jquery.google-script.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | js.ecommer.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | linked.livestreamanalytic.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | live.webfontupdate.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | s.jscore-group.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | s1.gridsumcontent.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | s1.jqueryclick.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | ssl.security.akamaihd-d.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | stat.cdnanalytic.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | static.livestreamanalytic.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | stats.corewidget.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | stats.widgetapi.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | update.akamaihd-d.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | update.security.akamaihd-d.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | update.webfontupdate.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | upgrade.liveupdateplugins.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | widget.jscore-group.com | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | wiget.adsfly.co | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| hostname | www.googleuserscontent.org | OTX pulse "OceanLotus Blossoms: Mass Digital Surveillance" | 2017-11-06 | AlienVault OTX |
| YARA | 81a5ae51ffd1ba3db8132b1e95fa9837d229f7c0 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-07-22 | AlienVault OTX |
| domain | facebook-cdn.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | gap-facebook.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | gl-appspot.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | notificeva.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | nsquery.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | teriava.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | tonholding.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | tulationeva.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | update-flashs.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| domain | vieweva.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | 24.datatimes.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | blog.docksugs.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | blog.panggin.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | check.paidprefund.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | contay.deaftone.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | economy.bloghop.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | emp.gapte.name | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | help.checkonl.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | high.expbas.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | high.vphelp.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | icon.torrentart.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | images.chinabytes.info | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | imaps.qki6.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | img.fanspeed.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | job.supperpow.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | menmin.strezf.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | mobile.pagmobiles.info | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | news.lighpress.info | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | push.relasign.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | seri.volveri.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | share.codehao.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | ssl.zin0.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | static.jg7.org | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | syn.timeizu.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | untitled.po9z.com | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | yii.yiihao126.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| hostname | zone.apize.net | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | 471a2e7341f2614b715dc89e803ffcac | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | 4f761095ca51bfbbf4496a4964e41d4f | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | 5180a8d9325a417f2d8066f9226a5154 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | 5458a2e4d784abb1a1127263bd5006b5 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | 6baafffa7bf960dec821b627f9653e44 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | aa1f85de3e4d33f31b4f78968b29f175 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | ce50e544430e7265a45fab5a1f31e529 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | e9abe54162ba4572c770ab043f576784 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | f1af6bb36cdf3cff768faee7919f0733 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | f6ee4b72d6d42d0c7be9172be2b817c1 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| FileHash-MD5 | fba089444c769700e47c6b44c362f96b | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
| CVE | CVE-2016-7255 | OTX pulse "APT32 and the Threat to Global Corporations" | 2017-05-14 | AlienVault OTX |
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.