Início / Grupos de ameaça / APT32

APT32 G0050

🔔 Criar alerta

Também conhecido como: SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

2

CVEs associadas

90

Técnicas

15

Malwares e ferramentas

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2017-11882 Alta · 7.8 KEV Ransomware Microsoft Office Memory Corruption Vulnerability

“(CVE-2017-11882)”

CVE-2016-7255 Alta · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability

“APT32 has used CVE-2016-7255 to escalate privileges.”

Técnicas por tática

Reconhecimento

T1589 Gather Victim Identity Information T1589.002 Email Addresses T1598.003 Spearphishing Link

Desenvolvimento de recursos

T1583.001 Domains T1583.006 Web Services T1585.001 Social Media Accounts T1588.002 Tool T1608.001 Upload Malware T1608.004 Drive-by Target

Acesso inicial

T1078.003 Local Accounts T1189 Drive-by Compromise T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1072 Software Deployment Tools T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1569.002 Service Execution T1574.001 DLL

Persistência

T1053.005 Scheduled Task T1078.003 Local Accounts T1112 Modify Registry T1137 Office Application Startup T1505.003 Web Shell T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1055 Process Injection T1068 Exploitation for Privilege Escalation T1078.003 Local Accounts T1543.003 Windows Service T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027.010 Command Obfuscation T1027.011 Fileless Storage T1027.013 Encrypted/Encoded File T1027.016 Junk Code Insertion T1036 Masquerading T1036.003 Rename Legitimate Utilities T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1055 Process Injection T1070.004 File Deletion T1070.006 Timestomp T1078.003 Local Accounts T1216.001 PubPrn T1218.005 Mshta T1218.010 Regsvr32 T1218.011 Rundll32 T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1564.004 NTFS File Attributes T1574.001 DLL

Comprometimento de defesas

T1112 Modify Registry T1222.002 Linux and Mac Permissions T1685.005 Clear Windows Event Logs

Acesso a credenciais

T1003 OS Credential Dumping T1003.001 LSASS Memory T1056.001 Keylogging T1552.002 Credentials in Registry

Descoberta

T1012 Query Registry T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Local Account T1135 Network Share Discovery

Movimento lateral

T1021.002 SMB/Windows Admin Shares T1072 Software Deployment Tools T1550.002 Pass the Hash T1550.003 Pass the Ticket T1570 Lateral Tool Transfer

Coleta

T1056.001 Keylogging T1560 Archive Collected Data

Comando e controle

T1071.001 Web Protocols T1071.003 Mail Protocols T1102 Web Service T1105 Ingress Tool Transfer T1571 Non-Standard Port

Exfiltração

T1041 Exfiltration Over C2 Channel T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malwares e ferramentas

Cobalt StrikeMalwareS0154
DenisMalwareS0354
GoopyMalwareS0477
KerrdownMalwareS0585
KOMPROGOMalwareS0156
OSX_OCEANLOTUS.DMalwareS0352
PHOREALMalwareS0158
RotaJakiroMalwareS1078
SOUNDBITEMalwareS0157
WINDSHIELDMalwareS0155
ArpFerramentaS0099
ipconfigFerramentaS0100
MimikatzFerramentaS0002
NetFerramentaS0039
netshFerramentaS0108

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.