APT32

APT32, also known as OceanLotus Group, APT-C-00, Canvas Cyclone, and Cobalt Kitty, is a threat actor group suspected to originate from Vietnam. Active since at least 2012, this group has targeted foreign companies investing in Vietnam's manufacturing, consumer products, consulting, and hospitality sectors. The group has been particularly interested in Vietnam’s emerging automotive industry, with confirmed attacks on one of the largest Japanese automotive manufacturers and its overseas operations in 2019. APT32 has also attacked governments, dissidents, and journalists in Southeast Asian countries, including Vietnam, demonstrating a wide-ranging scope of targets. The primary attack vector used by APT32 involves spear phishing emails containing malicious attachments. These actors leverage ActiveMime files that use social engineering techniques to trick victims into enabling macros. They are associated with several types of malware, including SOUNDBITE, WINDSHIELD, PHOREAL, BEACON, and KOMPROGO. One notable technique employed by APT32 is the use of publicly available exploits for vulnerabilities like CVE-2017-11882, a memory corruption vulnerability present in Microsoft Office software. This allows the group to achieve persistence on compromised systems without leaving traces. APT32 is notorious for heavily obfuscating their backdoors and scripts, a practice observed by Mandiant consultants in April 2017. They implement additional command argument obfuscation and leverage the regsvr32.exe application whitelisting bypass, tactics used by other threat groups like APT19. APT32 uses a combination of custom-developed, open-source, and commercially available tools, making them a sophisticated and persistent cyber threat. Their Command and Control (C2) infrastructure is vast, further highlighting their extensive operational capabilities.