APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.123
- FireEye APT32 May 2017
- Volexity OceanLotus Nov 2017
- ESET OceanLotus
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1550.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1072 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1570 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1216.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1012 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1598.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1041 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1189 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1222.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1137 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2017 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1003.001 | LSASS Memory | — |
| T1012 | Query Registry | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027.010 | Command Obfuscation | — |
| T1027.011 | Fileless Storage | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.016 | Junk Code Insertion | — |
| T1033 | System Owner/User Discovery | — |
| T1036 | Masquerading | — |
| T1036.003 | Rename Legitimate Utilities | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1041 | Exfiltration Over C2 Channel | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1056.001 | Keylogging | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1070.006 | Timestomp | — |
| T1071.001 | Web Protocols | — |
| T1071.003 | Mail Protocols | — |
| T1072 | Software Deployment Tools | — |
| T1078.003 | Local Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087.001 | Local Account | — |
| T1102 | Web Service | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1135 | Network Share Discovery | — |
| T1137 | Office Application Startup | — |
| T1189 | Drive-by Compromise | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1216.001 | PubPrn | — |
| T1218.005 | Mshta | — |
| T1218.010 | Regsvr32 | — |
| T1218.011 | Rundll32 | — |
| T1222.002 | Linux and Mac Permissions | — |
| T1505.003 | Web Shell | — |
| T1543.003 | Windows Service | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.002 | Pass the Hash | — |
| T1550.003 | Pass the Ticket | — |
| T1552.002 | Credentials in Registry | — |
| T1560 | Archive Collected Data | — |
| T1564.001 | Hidden Files and Directories | — |
| T1564.003 | Hidden Window | — |
| T1564.004 | NTFS File Attributes | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1569.002 | Service Execution | — |
| T1570 | Lateral Tool Transfer | — |
| T1571 | Non-Standard Port | — |
| T1574.001 | DLL | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1585.001 | Social Media Accounts | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1589.002 | Email Addresses | — |
| T1598.003 | Spearphishing Link | — |
| T1608.001 | Upload Malware | — |
| T1608.004 | Drive-by Target | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
APT32 · APT-C-00 · BISMUTH · Canvas Cyclone · OceanLotus · SeaLotus · 海莲花
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.