← Back to Actors
APT32
APT32SeaLotusOceanLotusAPT-C-00Canvas CycloneBISMUTH
[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)
79
Techniques
76
Covered
3
Gaps
96%
Coverage
Coverage76/79
COVERED (76)
T1003OS Credential Dumping114 det.T1003.001LSASS Memory111 det.T1012Query Registry25 det.T1016System Network Configuration Discovery41 det.T1018Remote System Discovery52 det.T1021.002SMB/Windows Admin Shares74 det.T1027.010Command Obfuscation42 det.T1027.011Fileless Storage4 det.T1027.013Encrypted/Encoded File8 det.T1033System Owner/User Discovery62 det.T1036Masquerading672 det.T1036.003Rename Legitimate Utilities47 det.T1036.004Masquerade Task or Service7 det.T1036.005Match Legitimate Resource Name or Location49 det.T1041Exfiltration Over C2 Channel32 det.T1046Network Service Discovery53 det.T1047Windows Management Instrumentation88 det.T1048.003Exfiltration Over Unencrypted Non-C2 Protocol23 det.T1049System Network Connections Discovery23 det.T1053.005Scheduled Task100 det.T1055Process Injection83 det.T1056.001Keylogging4 det.T1059Command and Scripting Interpreter552 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.005Visual Basic71 det.T1059.007JavaScript64 det.T1068Exploitation for Privilege Escalation104 det.T1070.001Clear Windows Event Logs16 det.T1070.004File Deletion46 det.T1070.006Timestomp10 det.T1071.001Web Protocols83 det.T1071.003Mail Protocols4 det.T1072Software Deployment Tools13 det.T1078.003Local Accounts24 det.T1082System Information Discovery91 det.T1083File and Directory Discovery49 det.T1087.001Local Account35 det.T1102Web Service36 det.T1105Ingress Tool Transfer199 det.T1112Modify Registry208 det.T1135Network Share Discovery20 det.T1137Office Application Startup18 det.T1189Drive-by Compromise13 det.T1203Exploitation for Client Execution81 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1216.001PubPrn2 det.T1218.005Mshta51 det.T1218.010Regsvr3243 det.T1218.011Rundll3278 det.T1222.002Linux and Mac Permissions19 det.T1505.003Web Shell70 det.T1543.003Windows Service80 det.T1547.001Registry Run Keys / Startup Folder53 det.T1550.002Pass the Hash10 det.T1550.003Pass the Ticket14 det.T1552.002Credentials in Registry7 det.T1560Archive Collected Data12 det.T1564.001Hidden Files and Directories26 det.T1564.003Hidden Window11 det.T1564.004NTFS File Attributes37 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1569.002Service Execution65 det.T1570Lateral Tool Transfer23 det.T1571Non-Standard Port17 det.T1574.001DLL111 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1588.002Tool13 det.T1589Gather Victim Identity Information1 det.T1589.002Email Addresses2 det.T1598.003Spearphishing Link353 det.T1608.001Upload Malware3 det.T1685.005Clear Windows Event Logs12 det.