File · APT32 · Nation-state · assessed origin Vietnam · misp-galaxy + mitre-attack · refreshed 2026-10-06
APT32
- OceanLotus Group
- Ocean Lotus
- OceanLotus
- Cobalt Kitty
- APT-C-00
- SeaLotus
- Sea Lotus
- APT-32
state sponsor · VietnamMITRE G0050 ↗
attack rose · 78 techniques across 14 tactics
What changed
ledger · newest first- —todaynew CVE2 new CVEs: CVE-2016-7255, CVE-2017-11882
Analyst brief
misp-galaxy + mitre-attackCyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.
Observed targets (as stated by the sources)
5 countries · 6 sectorsassessed origin · Vietnamobserved targets · 5
countries · 5
- China
- Germany
- United States
- Vietnam
- Philippines
sectors · 6
- Government
- Private sector
- Civil society
- Dissidents
- Government, Administration
- Journalist
also stated: Association of Southeast Asian Nations
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique78 techniques · 14 of 15 tactics
Reconnaissance
3 techniquesResource development
6 techniquesInitial access
3 techniquesExecution
12 techniquesPersistence
4 techniquesPrivilege escalation
1 techniqueStealth
20 techniquesDefense impairment
3 techniquesCredential access
3 techniquesDiscovery
10 techniquesLateral movement
4 techniquesCollection
2 techniquesCommand and control
5 techniquesExfiltration
2 techniques
select a technique
Arsenal
10 malware · 5 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
CVEs APT32 is cited as exploiting
none on KEV- CVE-2016-72552026-10-17
“APT32 has used CVE-2016-7255 to escalate privileges.”
cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
- CVE-2017-118822026-10-17
“APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)”
cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17
Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.
Primary-source reports
via APTnotes · linked, never re-hosted- 2022False flag or upgrade? Suspected sea lotus uses the Glitch platform to reproduce the attack sampleBlog ↗
- 2019OceanLotus APT Group Leveraging SteganographyCylance ↗
- 2017Cyber Espionage is Alive and Well: APT32 and the Threat to Global CorporationsFireEye ↗
- 2017Operation Cobalt Kitty: A large-scale APT in Asia carried out by the OceanLotus GroupCybereason ↗
- 2017Operation Cobalt Kitty Threat Actor Profile & IOCCybereason ↗
- 2017OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEANVolexity ↗
Take it with you
keyless · no signupReferences
19 sources- 1.attack.mitre.org/groups/G0050
- 2.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html
- 3.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-…
- 4.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-g…
- 5.brighttalk.com/webcast/10703/261205
- 6.github.com/eset/malware-research/tree/master/oceanlotus
- 7.cfr.org/interactive/cyber-operations/ocean-lotus
- 8.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware
- 9.secureworks.com/research/threat-profiles/tin-woodlawn
- 10.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-o…
- +9 more in the JSON record
Track APT32 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.