threat actor

APT32

unknownentity:threat_actor

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: apt32
kind: threat actor
status: unknown
aliases: APT 32 · APT-32 · APT-C-00 · ATK17 · BISMUTH · Canvas Cyclone · Cobalt Kitty · G0050 · Ocean Buffalo · Ocean Lotus · OceanLotus · OceanLotus Group · POND LOACH · Sea Lotus · SeaLotus · TIN WOODLAWN
jurisdictions: —
claims naming it: 0 · 0 attributions · 10 relations · 0 events

Identifiers

attack G0050via mitre-attack
misp-galaxy aa29ae56-e54b-47a2-ad16-d3ab0242d5d7via misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatAPT32usesKerrdown
fetch —sha256 dc1639caa5501d72
rel_103btcintel:relations:103@v1 sha256:6b78ff6a25dc3de0
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesCobalt Strike
fetch —sha256 dc1639caa5501d72
rel_104btcintel:relations:104@v1 sha256:0d0cb5080f085a2d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesSOUNDBITE
fetch —sha256 dc1639caa5501d72
rel_105btcintel:relations:105@v1 sha256:9c4312bd85472379
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesOSX_OCEANLOTUS.D
fetch —sha256 dc1639caa5501d72
rel_106btcintel:relations:106@v1 sha256:0ccf57c58f6cbbed
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesKOMPROGO
fetch —sha256 dc1639caa5501d72
rel_107btcintel:relations:107@v1 sha256:c034e4ee52f53423
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesRotaJakiro
fetch —sha256 dc1639caa5501d72
rel_108btcintel:relations:108@v1 sha256:f1ec8f2f15c59a4c
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesPHOREAL
fetch —sha256 dc1639caa5501d72
rel_109btcintel:relations:109@v1 sha256:80a316bd289e9b15
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesWINDSHIELD
fetch —sha256 dc1639caa5501d72
rel_110btcintel:relations:110@v1 sha256:54644a8d173d1168
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesDenis
fetch —sha256 dc1639caa5501d72
rel_111btcintel:relations:111@v1 sha256:fcdbe2e8ed5f7bb3
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT32usesGoopy
fetch —sha256 dc1639caa5501d72
rel_112btcintel:relations:112@v1 sha256:bd6aed364bb1c989
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.