OceanLotus

OceanLotus, also known as APT32, is a threat actor suspected to be linked to Vietnam. This group primarily targets foreign companies operating in sectors such as manufacturing, consumer products, consulting, and hospitality within Vietnam. The group's activities suggest it poses a significant risk to businesses operating or intending to invest in the country. Recent investigations have revealed new tools used by OceanLotus in its cyber-attacks, including macOS backdoor malware, although the infection vector for these attacks remains unidentified. In 2023, a report by Elastic Lab highlighted an attack by OceanLotus that employed a novel set of malicious tools dubbed Spectral Viper. Furthermore, there are striking similarities between the RotaJakiro malware and the macOS version of OceanLotus. Despite being implemented in different languages, their function, message format design, and specific implementation are too alike to be coincidental. For instance, both use the same parameters when encrypting registration packets and share several identical instruction codes. The likelihood that RotaJakiro is a Linux version of OceanLotus is high, given the shared features and functions. Both utilize DWORD type instruction codes to specify message functions and employ a function called rotate() for encryption/decryption. Moreover, they assign identical message codes to registration packets. Additionally, OceanLotus and RotaJakiro share identical field values at certain offsets, which further strengthens the possibility of a common origin. Therefore, the cybersecurity community should remain vigilant to the evolving threat landscape posed by groups like OceanLotus.