OceanLotus

OceanLotus, also known as APT32, is a threat actor suspected to be linked with Vietnam. It primarily targets foreign companies involved in manufacturing, consumer products, consulting, and hospitality sectors that are investing or planning to invest in Vietnam. The group's recent activities indicate an ongoing threat to these businesses operating within the country. OceanLotus employs a range of sophisticated tools in its attack arsenal, as revealed during the investigation of Operation Cobalt Kitty by Cybereason. One significant discovery was the use of macOS Backdoor Malware, a tool linked directly to the OceanLotus Group. Moreover, there appears to be a strong correlation between OceanLotus and another malware entity called RotaJakiro. Despite being implemented in different languages, their function, message format design, and specific implementation bear striking similarities. For instance, both employ the same parameters when encrypting registration packets, suggesting that RotaJakiro could potentially be a Linux version of the OceanLotus. Further analysis has demonstrated shared characteristics between the two entities, such as using DWORD type instruction codes to specify message functions and employing similar encryption/decryption methods. Both RotaJakiro and OceanLotus assign identical message codes to registration packets, and they share the same field values at certain offsets. They also structure their network packets similarly and use separate data structures to hold command and control (C2) session information. These findings significantly increase the likelihood that RotaJakiro and OceanLotus originate from the same source, indicating a high level of sophistication and coordination in their cyber-espionage operations.