APT32 Targeting NGOs: A Perspective

APT32, also tracked as OceanLotus, is a cyber espionage group widely assessed to be linked to Vietnam. MITRE ATT&CK describes it as a suspected Vietnam-based group. This post covers two campaigns. One is its August 2024 intrusion against a Vietnamese human-rights firm. The other is a 2025 campaign that used a backdoored Cobalt Strike plugin on GitHub to target security professionals.

For the group’s wider record, see our APT32 (OceanLotus) threat group profile.

Executive Summary

OceanLotus (APT32) is a Vietnam-linked espionage actor with sustained activity in Southeast Asia and beyond. In August 2024 the group executed a multi-year intrusion against a Vietnamese human-rights firm. It used custom backdoors, scheduled-task and registry persistence, and selective data theft. In 2025 the group stepped up its supply-chain and developer-ecosystem tradecraft. It distributed a backdoored Cobalt Strike plugin on GitHub that targeted security professionals. This shows a shift toward abusing trusted developer workflows.

Who Is APT32? A Threat Actor Profile

Attribution & Background

OceanLotus, also tracked as APT32, Cobalt Kitty, and SeaLotus, is a cyber espionage group widely assessed to be linked to Vietnam. The group has been active since at least 2012. Its operations mainly target political, economic, and security interests in Southeast Asia. Its activity has also spread worldwide.

Motivation

APT32’s campaigns match state-level goals. They focus on intelligence collection that supports Vietnam’s strategic, political, and economic goals. The group has historically targeted government agencies, foreign corporations, journalists, and dissidents. In recent years it has widened its focus to NGOs, civil society firms, and cybersecurity professionals.

Threat Level

OceanLotus (APT32) represents a high-threat, state-aligned espionage actor with both regional focus and global reach. The group’s advanced tradecraft, custom toolset, and steady targeting of NGOs are a lasting risk. Firms that handle sensitive political, human-rights, or regional affairs are most exposed. Its operations show a blend of technical expertise and strategic patience. It keeps long-term access to victims and evades detection through stealthy persistence methods and selective data theft.

APT32’s campaigns consistently match Vietnam’s state-level goals. They support the nation’s strategic, political, and economic interests. The actor shows exceptional skill in exploiting trusted ecosystems to deliver and manage its malware. These include open-source repositories, software supply chains, and legitimate cloud services.

This mix of technical skill, discipline, and adaptability makes OceanLotus one of the most capable and resilient APT actors in the Asia-Pacific region. It is a real and ongoing threat to regional civil-society groups and to global cybersecurity professionals alike.

How Does APT32 Gain Initial Access?

NGOs Targeting Campaigns

In 2024, attack chains targeting NGOs and civil-society firms often began with highly targeted spear-phishing lures. These were specially crafted emails or fake invitations sent to specific staff. Those messages delivered malicious attachments or weaponized links. They deployed backdoors that could run arbitrary shellcode in memory. The backdoors could also harvest credentials and sensitive documents, and set up long-term covert access.

Backdoored Github Repository

In the 2025 GitHub campaign, OceanLotus (APT32) used a new method of initial access and execution. It relied on software supply chain abuse and on exploiting developer trust. The group uploaded a backdoored Cobalt Strike exploit plugin to GitHub and embedded a malicious .suo file within a Visual Studio project.

Custom Backdoors and Toolsets

OceanLotus relies on a modular arsenal. It combines custom implants with repurposed frameworks such as Cobalt Strike.

Key parts observed include:

• Cobalt Strike Beacons configured for encrypted C2 via HTTPS and cloud storage.
  • Lightweight loaders that deploy embedded DLL payloads.
  • Cookie and credential harvesters targeting every Chrome user profile.
  • Persistence utilities that create scheduled tasks and registry run keys for long-term access.

Tactics, Techniques, and Procedures (TTPs)

In the August 2024 campaign against Vietnamese NGOs, OceanLotus (APT32) kept long-term access. It used scheduled tasks, registry-based COM persistence, and living-off-the-land execution. The group created many user-scoped scheduled tasks such as AdobeUpdateTaskUser<SID>, WinDefenderAntivirusUpdateTaskUser<SID2>Core, and Handler{GUID} to execute malicious payloads at set intervals or on demand.

One task, for instance, launched a malicious Java archive (adobe.jar). It contained an embedded DLL (mi54giwp.dll) designed to load encrypted shellcode from a fake image file (adobe.png). Another task, WinDefenderAntivirusUpdateTaskUser<SID2>Core, executed a VBScript (MSSharePoint.vbs) that authenticated to a remote SFTP server using a private key dropped on disk. This script then downloaded and ran another part (cloud.bat), establishing an extra persistence method that executed every five hours.

The attack chain also used COM object hijacking for stealth. It used DllHost.exe as a surrogate process to register and execute a malicious DLL tied to the CLSID {1F7CFAF8-B558-4EBD-9526-203135A79B1D}. This let OceanLotus start new scheduled tasks from inside legitimate Windows processes. Malicious activity blended in with normal system behavior.

In this 2025 campaign, OceanLotus (APT32) used GitHub to deliver a trojanized security tool aimed at cybersecurity professionals. The attackers uploaded a malicious version of a Cobalt Strike exploit plugin to a public GitHub repository. They hid a payload inside a .suo (Solution User Options) file within a Visual Studio project.

When victims cloned and compiled the Visual Studio project, the malicious .suo file ran by itself and triggered the malware. This execution gave OceanLotus initial access to the victim’s environment. The group could then steal sensitive data such as user identities, local environment details, and possibly network credentials.

By targeting a tool that cybersecurity professionals commonly use, OceanLotus aimed to reach firms indirectly. It went through trusted people and research environments. The use of GitHub gave the plugin both credibility and distribution reach. The .suo file abuse kept it stealthy, because the file blends in with legitimate project files that often go unnoticed in audits.

Indicators of Compromise (IoCs)

• 190.211.254[.]203

• 45.41.204[.]18

• 45.41.204[.]15

• 178.255.220[.]115

• 103.91.67[.]74

• 154.93.37[.]106

• 193.138.195[.]192

• 38.54.59[.]112

• 51.81.29[.]44

• 300ef93872cc574024f2402b5b899c834908a0c7da70477a3aeeaee2e458a891

• efc373b0cda3f426d25085938cd02b7344098e773037a70404c6028c76cc16fc

• 6c08a004a915ade561aee4a4bec7dc588c185bd945621ec8468575a399ab81f4

• ea8a00813853038820ba50360c5c1d57a47d72237e3f76c581d316f0f1c6e85f

• 0ed2e66f9442a09e04ca33cfcc8429c536f0019a1adfc2db2543a7515ccdea6b

• 1149c398cc37743395327f94b359b363903a64bf322d40f5d76160f92c52fbd1

Conclusion

The recent operations attributed to OceanLotus (APT32) clearly show how the group has grown, adapted, and planned. The group moved from the August 2024 campaign against Vietnamese human-rights firms to the 2025 GitHub operation aimed at cybersecurity professionals. This shows that OceanLotus can pivot between victim sectors. It keeps a consistent emphasis on stealth, persistence, and intelligence collection.

OceanLotus remains a high-priority adversary. It combines targeted intelligence goals, patience, and a growing use of trusted ecosystems (open-source platforms and third-party tooling). Defenders should do the following:

• Assume developer and research toolchains are potential vectors.
• Prioritize build isolation and provenance checks.
• Hunt for low-and-slow persistence artifacts (scheduled tasks, COM/DllHost misuse).
• Share IOCs across NGO/CERT communities to reduce collective risk.