APT32, better known as OceanLotus, is a Vietnam-based espionage group that targets foreign companies doing business in Vietnam, regional governments, and Vietnamese activists and journalists, and it is one of the few state-aligned groups with long-running macOS backdoors alongside its Windows toolset. Its intrusions combine watering holes and tailored phishing with signed-binary side-loading, abuse of security management consoles such as McAfee ePO, and patient credential theft that included capturing passwords as users changed them. This profile is for SOC analysts, endpoint and macOS administrators, and threat intelligence teams at multinationals with operations in Southeast Asia, regional governments, media and civil society organisations. It covers names and attribution as each source states it, targeting, the ATT&CK techniques mapped to the group, how it abuses credentials and admin tools, notable activity, and a detection and hardening plan. Wider context on state groups is in the Threat Actor Groups Guide.
Key takeaways
- Business and dissidents, both. Mandiant describes targeting of foreign corporations with interests in Vietnam's manufacturing, consumer products and hospitality sectors, and Meta reports Vietnamese human rights activists, NGOs, news agencies and the governments of Laos and Cambodia.
- macOS is in scope. ATT&CK tracks the OSX_OCEANLOTUS.D backdoor, first discovered in 2015, and Trend Micro found a 2020 variant hidden as a Word document using an invisible Unicode character.
- It turns your security tools against you. ATT&CK and Mandiant record malware distributed as a McAfee ePO deployment task and DLLs side-loaded by signed Symantec and McAfee executables.
- Credential theft is thorough. Mimikatz, Outlook credential dumping from the registry, PasswordChangeNotify abuse, pass the hash and pass the ticket are all mapped to the group.
- Commodity noise can be cover. Microsoft saw the related BISMUTH actor deploy coin miners in 2020 so that alerts would look low priority; investigate miners on sensitive networks properly.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as APT32 (G0050), a suspected Vietnam-based threat group active since at least 2014, with a strong focus on Vietnam, the Philippines, Laos and Cambodia and extensive use of strategic web compromises. Mandiant assessed in 2017 that APT32 is a cyber espionage group aligned with Vietnamese government interests and dated its targeting of dissidents and journalists to at least 2013. Meta described APT32 in December 2020 as an advanced persistent threat actor based in Vietnam and said its investigation linked the activity to CyberOne Group, an IT company in Vietnam. Microsoft says BISMUTH shares similarities with OceanLotus and APT32. No government attribution statement was found in the sources reviewed.
| Name | Tracked by | Notes |
|---|---|---|
| APT32 | Mandiant / Google, ATT&CK | ATT&CK primary name |
| OceanLotus | Qihoo 360 SkyEye Labs (per Mandiant), ESET, Trend Micro | Most common name in macOS reporting |
| Canvas Cyclone (earlier BISMUTH) | Microsoft | Listed in ATT&CK; Microsoft describes similarities, not identity |
| SeaLotus, APT-C-00 | Other vendors | Aliases listed in ATT&CK |
| CyberOne Group (also CyberOne Security, Planet) | Meta | Company Meta linked to the activity |
For other Asia-focused groups see the China State Cyber Operations Guide; APT32 is a separate, Vietnam-based actor and should not be grouped with PRC clusters.
Targeting and motivation
- Foreign business in Vietnam: manufacturing, consumer products and hospitality firms, plus network security, technology infrastructure, banking and media companies (Mandiant). Meta adds IT, hospitality, agriculture, healthcare, retail and automotive businesses.
- Governments: a Western national legislature in 2014 and Philippine government employees (Mandiant); Laos and Cambodia (Meta); government institutions in France and Vietnam during BISMUTH's 2020 campaigns (Microsoft).
- Civil society: Vietnamese dissidents, activists, bloggers, journalists and the diaspora, with diaspora lures seen in Australia (Mandiant), and human rights activists locally and abroad (Meta). ATT&CK records collection of activists' and bloggers' email addresses for spyware targeting.
- Vietnam's economy: Microsoft reports BISMUTH targeting former state-owned enterprises, buyers of significant stakes in them, and companies transacting with Vietnamese government agencies.
- Motivation: espionage aligned with Vietnamese government interests (Mandiant), including commercial intelligence and surveillance of critics.
Tactics and techniques (MITRE ATT&CK)
All techniques below are mapped to G0050 in ATT&CK v20, which records about 78 technique uses. Software includes Cobalt Strike, WINDSHIELD, KOMPROGO, SOUNDBITE, PHOREAL, Denis, Kerrdown, Goopy and OSX_OCEANLOTUS.D.
| Tactic | Technique | How it shows up |
|---|---|---|
| Resource development | T1608.004 Drive-by Target; T1585.001 Social Media Accounts | Websites filled with scraped articles to look legitimate; Facebook pages alongside fake sites |
| Initial access | T1189 Drive-by Compromise | Watering holes with obfuscated JavaScript that profiles visitors |
| Initial access | T1566.001, T1566.002; T1598.003 Spearphishing Link | Executables disguised as documents, ActiveMime .mht files posing as .doc, credential harvesting pages |
| Execution | T1203 Exploitation for Client Execution | RTF exploiting CVE-2017-11882 |
| Execution, stealth | T1218.010 Regsvr32; T1218.005 Mshta; T1216.001 PubPrn | Scheduled tasks running COM scriptlets through regsvr32 (Squiblydoo) and mshta |
| Persistence | T1053.005 Scheduled Task; T1137 Office Application Startup | Tasks named "Windows Scheduled Maintenance" and "Scheduled Defrags"; Outlook VbaProject.OTM replaced with a backdoor macro |
| Stealth | T1574.001 DLL; T1036.004 Masquerade Task or Service | Signed Symantec and McAfee executables loading malicious DLLs; non-printing Unicode in service names |
| Privilege escalation | T1068 Exploitation for Privilege Escalation | CVE-2016-7255, disguised as a Windows hotfix |
| Credential access | T1003.001 LSASS Memory; T1552.002 Credentials in Registry; T1056.001 Keylogging | Mimikatz; Outlook Credential Dumper; PasswordChangeNotify abuse to capture new passwords |
| Lateral movement | T1550.002 Pass the Hash; T1550.003 Pass the Ticket; T1072 Software Deployment Tools | Hash and ticket reuse; malware pushed as a McAfee ePO deployment task |
| Command and control, exfiltration | T1071.003 Mail Protocols; T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol | Email C2 from an Office macro; data encoded in DNS subdomains; SOUNDBITE uses DNS and PHOREAL ICMP (Mandiant) |
| Defence impairment, stealth | T1685.005 Clear Windows Event Logs; T1070.006 Timestomp; T1564.004 NTFS File Attributes | Selective log clearing, backdated task XML, payloads in alternate data streams |
| macOS | T1222.002 Linux and Mac Permissions; T1564.001 Hidden Files and Directories | Backdoor sets payload permissions to 755 and hides files with chflags |
How they abuse identities and credentials
APT32's intrusions repeatedly turn administrative trust into reach: local admin passwords, Kerberos tickets and, most damagingly, the service accounts behind security management consoles.
| Abuse | Detail from sources | Control |
|---|---|---|
| Shared local admin credentials | Legitimate local admin credentials used to move and deploy tools (T1078.003, T1570) | Unique local admin passwords with Windows LAPS; deny network logon for local accounts. See the Local Administrator Password Solution (LAPS) Guide |
| Hash and ticket reuse | Pass the hash and pass the ticket | Credential Guard, Protected Users for admins, privileged accounts kept off workstations (Microsoft's BISMUTH advice) |
| Password change capture | PasswordChangeNotify abuse records new passwords | Baseline LSA Notification Packages and alert on change; LSA protection |
| Mail client secrets | Outlook credentials read from the registry; Outlook VBA project replaced | Modern authentication for mail, block Outlook VBA, alert on VbaProject.OTM changes |
| Security console service accounts | McAfee ePO used to push malware as a deployment task | Treat EDR, AV and deployment consoles as Tier 0: MFA, dedicated admin accounts, change approval and alerting on new deployment tasks |
| Domain-wide admin service accounts | Microsoft warns against them in its BISMUTH guidance | Scope service accounts to the hosts they need; use gMSA. See the Service Account Security Guide |
- Social media identities: Meta describes fictitious personas with backstories and romantic lures. Staff in target sectors and activists should verify new contacts before opening files.
- macOS user context: the 2020 backdoor runs as a LaunchAgent in the user's context, so it inherits the user's keychain access and sessions; reset the user's credentials after removal. See the macOS Security Guide for Enterprises.
Notable incidents
| Date | Activity | Source |
|---|---|---|
| 2013 onward | Targeting of Vietnamese dissidents and journalists; private sector from 2014; a Western national legislature in 2014 | Mandiant, 14 May 2017 |
| 2014 to 2017 | Intrusions into foreign corporations with interests in Vietnam; McAfee ePO abuse; WINDSHIELD, KOMPROGO, SOUNDBITE, PHOREAL | Mandiant |
| 2015 onward | OSX_OCEANLOTUS.D macOS backdoor, extended with plugins over time | MITRE ATT&CK S0352 |
| July to August 2020 | BISMUTH campaigns against government and private sector in France and Vietnam, with coin miners as cover | Microsoft, 30 November 2020 |
| November 2020 | New macOS backdoor variant disguised as a Word document with a hidden Unicode character | Trend Micro, 27 November 2020 |
| December 2020 | Meta removes accounts, blocks domains and links the activity to CyberOne Group | Meta, 10 December 2020 |
Detection and defence
Detection signals
| Signal | Where to look | Notes |
|---|---|---|
| Scheduled tasks launching regsvr32 with a remote scriptlet, or mshta | Task Scheduler logs (Event ID 4698), process creation | Check task names that imitate maintenance jobs |
| Signed security vendor executables or winword.exe running from unusual folders and loading unsigned DLLs | EDR image load events, Sysmon Event ID 7 | Side-loading; Microsoft cites winword.exe, dbgview.exe and msmpeng.exe |
| New deployment tasks or policies in ePO or other AV and EDR consoles outside change windows | Console audit logs forwarded to the SIEM | Security tools as a lateral movement channel |
| Service or task names containing non-printing Unicode characters | Event ID 7045 and 4697, hunting scripts | Mandiant documents this masquerading |
| Security log cleared (1102) or PowerShell operational log deleted | SIEM | Both Mandiant and Microsoft describe log clearing |
| Privileged accounts logging on to workstations (4624) | Domain controller and endpoint logs | Microsoft's BISMUTH guidance |
| Coin miners on servers or sensitive workstations | EDR, NetFlow to mining pools | Investigate as a possible cover for espionage |
| App bundles with document icons, Unicode variation selectors in names, or new LaunchAgents | macOS EDR, file events in ~/Library/LaunchAgents | Trend Micro's 2020 variant used com.apple.marcoagent.voiceinstallerd.plist |
Hardening plan
- Week 1: patch Office (CVE-2017-11882) and Windows privilege escalation flaws; restrict macros by policy; enable attack surface reduction rules in audit mode.
- Weeks 2 to 4: put EDR, AV and software deployment consoles under Tier 0 controls: dedicated admin accounts with MFA, approval for new deployment tasks, and alerts forwarded to the SIEM.
- Weeks 4 to 8: deploy Windows LAPS, deny network logon for local accounts, enable Credential Guard, and keep privileged accounts off workstations. Enforce ASR rules after reviewing audit results, keeping audit mode as the rollback.
- Quarter 1: on macOS, enforce Gatekeeper and notarisation, monitor LaunchAgents and LaunchDaemons through EDR, and block execution of unsigned apps from downloaded archives. See the macOS Detection and Response Guide.
- Ongoing: restrict servers from arbitrary internet access, limit SMB and RPC between endpoints, and brief staff with Vietnam operations on persona-based social engineering.
Metrics
- Security consoles with MFA and alerting on new deployment tasks: 100%.
- Endpoints with unique local admin passwords: above 98%.
- Privileged account logons to workstations per week: trending to zero.
- macOS devices with EDR and LaunchAgent monitoring: 100% of managed Macs.
- Coin miner detections investigated to root cause: 100%.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | AC-6 Least Privilege, IA-5 Authenticator Management | Local admin passwords, privileged accounts off workstations |
| NIST SP 800-53 Rev. 5 | CM-5 Access Restrictions for Change, CM-7 Least Functionality | Controlling deployment consoles and script hosts |
| NIST SP 800-53 Rev. 5 | SI-4 System Monitoring, AU-9 Protection of Audit Information | Detecting side-loading and protecting logs from clearing |
| NIST CSF 2.0 | PR.AA-05, DE.CM-09 | Access permissions and endpoint monitoring |
| MITRE D3FEND | D3-PSA Process Spawn Analysis | Office and script host process chains |
Practitioner checklist
- Audit who can create deployment tasks in ePO and other security consoles, and alert on every new task.
- Hunt for scheduled tasks using regsvr32 scriptlets or mshta and for Unicode tricks in task and service names.
- Detect signed vendor binaries and Office executables loading DLLs from user-writable paths.
- Deploy Windows LAPS and keep privileged accounts off workstations.
- Baseline LSA Notification Packages and watch for password change capture.
- Monitor macOS LaunchAgents and block unsigned apps from downloaded archives.
- Forward Security and PowerShell logs off host and alert on clearing.
- Treat coin miners on sensitive systems as possible cover for espionage.
Standards and references
- MITRE ATT&CK: APT32 (G0050)
- MITRE ATT&CK: OSX_OCEANLOTUS.D (S0352)
- MITRE ATT&CK: Software Deployment Tools
- Mandiant: Cyber Espionage is Alive and Well, APT32 and the Threat to Global Corporations
- Microsoft Threat Intelligence: Threat actor leverages coin miner techniques to stay under the radar
- Trend Micro: New macOS backdoor connected to OceanLotus surfaces
- Meta: Taking action against hackers in Bangladesh and Vietnam
Related NHI Mgmt Group resources: Threat Actor Groups Guide · macOS Detection and Response Guide · Watering Hole Attacks Guide · Cobalt Strike Abuse Detection Guide · Local Administrator Password Solution (LAPS) Guide