APT32

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

The group is suspected of operating with the support of Vietnam.

The group is associated with 18 malware families.

Also known as: OceanLotus Group, Ocean Lotus, OceanLotus, Cobalt Kitty, APT-C-00, SeaLotus, Sea Lotus, APT-32, APT 32, Ocean Buffalo, POND LOACH, TIN WOODLAWN, BISMUTH, ATK17, G0050, Canvas Cyclone

The group is associated with 18 malware families.

Published reports on this actor:

• https://attack.mitre.org/groups/G0050/
• https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html
• https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/

Source: MISP Galaxy, Malpedia.