Home / Threat actors / APT32

APT32 G0050

🔔 Create alert

Also known as: SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2

associated CVEs

90

Techniques

15

Malware and tools

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2017-11882 High · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability

“(CVE-2017-11882)”

CVE-2016-7255 High · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability

“APT32 has used CVE-2016-7255 to escalate privileges.”

Techniques by tactic

Reconnaissance

T1589 Gather Victim Identity Information T1589.002 Email Addresses T1598.003 Spearphishing Link

Resource Development

T1583.001 Domains T1583.006 Web Services T1585.001 Social Media Accounts T1588.002 Tool T1608.001 Upload Malware T1608.004 Drive-by Target

Initial Access

T1078.003 Local Accounts T1189 Drive-by Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1072 Software Deployment Tools T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution T1574.001 DLL

Persistence

T1053.005 Scheduled Task T1078.003 Local Accounts T1112 Modify Registry T1137 Office Application Startup T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled Task T1055 Process Injection T1068 Exploitation for Privilege Escalation T1078.003 Local Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Stealth

T1027.010 Command Obfuscation T1027.011 Fileless Storage T1027.013 Encrypted/Encoded File T1027.016 Junk Code Insertion T1036 Masquerading T1036.003 Rename Legitimate Utilities T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.004 File Deletion T1070.006 Timestomp T1078.003 Local Accounts T1216.001 PubPrn T1218.005 Mshta T1218.010 Regsvr32 T1218.011 Rundll32 T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1564.004 NTFS File Attributes T1574.001 DLL

Defense Impairment

T1112 Modify Registry T1222.002 Linux and Mac Permissions T1685.005 Clear Windows Event Logs

Credential Access

T1003 OS Credential Dumping T1003.001 LSASS Memory T1056.001 Keylogging T1552.002 Credentials in Registry

Discovery

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1135 Network Share Discovery

Lateral Movement

T1021.002 SMB/Windows Admin Shares T1072 Software Deployment Tools T1550.002 Pass the Hash T1550.003 Pass the Ticket T1570 Lateral Tool Transfer

Collection

T1056.001 Keylogging T1560 Archive Collected Data

Command and Control

T1071.001 Web Protocols T1071.003 Mail Protocols T1102 Web Service T1105 Ingress Tool Transfer T1571 Non-Standard Port

Exfiltration

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malware and tools

Cobalt StrikeMalwareS0154
DenisMalwareS0354
GoopyMalwareS0477
KerrdownMalwareS0585
KOMPROGOMalwareS0156
OSX_OCEANLOTUS.DMalwareS0352
PHOREALMalwareS0158
RotaJakiroMalwareS1078
SOUNDBITEMalwareS0157
WINDSHIELDMalwareS0155
ArpToolS0099
ipconfigToolS0100
MimikatzToolS0002
NetToolS0039
netshToolS0108

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.