Quick links
Press Enter to search, Esc to close
Threat group profile
MITRE ATT&CK describes APT32 (OceanLotus) as a suspected Vietnam-based threat group active since at least 2014 that targets governments, dissidents, journalists and companies, mainly in Southeast Asia.
In short
MITRE ATT&CK describes APT32 (OceanLotus) as a suspected Vietnam-based threat group active since at least 2014 that targets governments, dissidents, journalists and companies, mainly in Southeast Asia. CERT-EU calls it Vietnam-linked, but no government indictment or sanction names it. The latest dated activity in these sources is January 2025.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| APT32 | Main name on the MITRE ATT&CK group page G0050; also used by the BSI 2017 report and CERT-EU[1, 2, 3] |
| OceanLotus | MITRE ATT&CK Associated Groups list; BSI 2017 report (as APT32/OceanLotus); CERT-EU[1, 2, 4] |
| SeaLotus | MITRE ATT&CK Associated Groups list[1] |
| APT-C-00 | MITRE ATT&CK Associated Groups list[1] |
| Canvas Cyclone | MITRE ATT&CK Associated Groups list[1] |
| BISMUTH | MITRE ATT&CK Associated Groups list[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
MITRE ATT&CK 31 July 2026 (page last modified)
Describes APT32 as a suspected Vietnam-based threat group active since at least 2014.[1]
MITRE ATT&CK 31 July 2026 (page last modified)
Says the group has targeted private sector industries, foreign governments, dissidents and journalists, with a strong focus on Vietnam, the Philippines, Laos and Cambodia.[1]
MITRE ATT&CK 31 July 2026 (page last modified)
Says the group has used strategic web compromises, meaning it breaks into websites its targets visit.[1]
MITRE ATT&CK 31 July 2026 (page last modified)
Lists SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone and BISMUTH as associated groups.[1]
German Federal Office for Information Security (BSI) 2017 report
Lists APT32/OceanLotus in a figure of cyber espionage groups active worldwide, under government institutions, opposition and media. It does not name a country in that figure.[2]
CERT-EU 1 December 2022
Calls APT32 a Vietnam-linked threat actor and records a report that it compromised a digital certificate authority in an Asian country.[3]
CERT-EU 3 February 2025
Calls OceanLotus (APT32) a Vietnam-linked APT group and records a 9 January 2025 report that it targeted Chinese cybersecurity professionals and large enterprises through a poisoned GitHub repository.[4]
Only MITRE ATT&CK and CERT-EU give a country, and both are cautious. MITRE says "suspected Vietnam-based". CERT-EU says "Vietnam-linked" and passes on reports from private firms. No government advisory, indictment or sanction naming the group was found, so no government names a sponsoring body. The BSI lists the group but names no country in that figure.
Each entry is attributed to the group by the sources cited.
MITRE says APT32 has been active since at least 2014.[1]
MITRE says OSX_OCEANLOTUS.D, a macOS backdoor used by APT32, was first discovered in 2015.[7]
The BSI report The State of IT Security in Germany 2017 lists APT32/OceanLotus among espionage groups active worldwide.[2]
MITRE created its APT32 page on this date.[1]
CERT-EU lists a report that APT32 compromised a digital certificate authority in an Asian country.[3]
A report recorded by CERT-EU says OceanLotus (APT32) targeted Chinese cybersecurity professionals and large enterprises with a poisoned GitHub repository.[4]
MITRE ATT&CK last modified its APT32 page, version 3.0.[1]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 2017 | German Federal Office for Information Security (BSI) | Situation reportThe State of IT Security in Germany 2017 lists APT32/OceanLotus among cyber espionage groups active worldwide.[2] |
| 1 December 2022 | CERT-EU | Threat intelligence briefCyber Security Brief of November 2022 records a report that APT32, a Vietnam-linked actor, compromised a digital certificate authority in an Asian country.[3] |
| 3 February 2025 | CERT-EU | Threat intelligence briefCyber Brief 25-02 records a 9 January 2025 report of OceanLotus (APT32) activity against Chinese cybersecurity professionals.[4] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Acquire Infrastructure: Domains T1583.001
MITRE says APT32 set up and operated websites to gather information and deliver malware.[1]
Stage Capabilities: Drive-by Target T1608.004
MITRE says it stood up websites with scraped articles to look legitimate, some with malicious JavaScript or a fake software update.[1]
Drive-by Compromise T1189
MITRE says it infected victims by tricking them into visiting compromised watering hole websites.[1, 13]
Phishing: Spearphishing Attachment T1566.001
MITRE says it sent emails with a malicious executable disguised as a document or spreadsheet.[1]
Phishing: Spearphishing Link T1566.002
Hijack Execution Flow: DLL T1574.001
MITRE says it side-loads its backdoor by dropping a library next to a legitimate signed executable.[1, 14]
Obfuscated Files or Information: Encrypted/Encoded File T1027.013
MITRE says it encoded payloads with Base64 and used a framework called Dont-Kill-My-Cat (DKMC).[1]
Denis Windows backdoor
MITRE says it is a Windows backdoor and Trojan used by APT32, similar to SOUNDBITE and used with Goopy.[5]
Goopy Windows backdoor
MITRE says it impersonates the legitimate Google Updater executable and is similar to Denis.[6]
OSX_OCEANLOTUS.D macOS backdoor
MITRE says it was first discovered in 2015 and extends its abilities with plugins.[7]
RotaJakiro Linux backdoor
MITRE says it is a 64-bit Linux backdoor first seen in 2018.[8]
Kerrdown Downloader
MITRE says it is a custom downloader used since at least 2018 to install spyware.[9]
Cobalt Strike Commercial remote access tool
MITRE says APT32 used it, for example disguised as a Flash installer.[10, 1]
Mimikatz Credential dumper
MITRE says it can obtain plaintext Windows logins and passwords, and APT32 used it.[11, 1]
SOUNDBITE Backdoor
MITRE lists it as software used by APT32.[1]
WINDSHIELD Backdoor
MITRE lists it as software used by APT32.[1]
MITRE advises SPF, DKIM and DMARC so recipients can filter messages from fake sender domains.
Counters T1566.002
MITRE advises browser sandboxes and exploit protection tools to limit the effect of a booby-trapped website.
Counters T1189
MITRE advises application control that blocks DLLs loaded by legitimate software, and disallowing remote DLLs.
Counters T1574.001
MITRE advises disabling Office VBA macros and add-ins, or requiring signed add-ins.
Counters T1137
MITRE advises auditing tools that find DLL search order weaknesses so they can be fixed.
Counters T1574.001
Customers can follow reported activity from groups linked to Southeast Asia and check it against their own sector and region.
Customers can watch for lookalike domains and fake websites that imitate their organization.
Customers can find exposed websites and services that attackers could compromise or abuse.
Customers can look for exposure of senior staff and public figures that could be used to target them.
MITRE ATT&CK describes APT32 as a suspected Vietnam-based threat group active since at least 2014. CERT-EU calls it Vietnam-linked. No government indictment or sanction was found.
MITRE ATT&CK lists OceanLotus, SeaLotus, APT-C-00, Canvas Cyclone and BISMUTH as associated groups. The BSI and CERT-EU also use the OceanLotus name next to APT32.
MITRE says private sector industries, foreign governments, dissidents and journalists, with a focus on Vietnam, the Philippines, Laos and Cambodia. The BSI 2017 report lists it under government, opposition and media.
MITRE says it uses spearphishing emails with attachments or links, and compromised websites that its targets visit. It then installs backdoors, often by DLL side-loading.
Only the German BSI (2017 report) and CERT-EU (2022 and 2025 briefs) were found, and neither gives a sponsoring body. Sources are thin, so treat attribution as unconfirmed.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.