APT32
Threat actorAttributed to Vietnam by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT32Our name
- APT-C-00ESET
- OceanLotusMandiant
- BISMUTHMicrosoft
- Canvas CycloneMicrosoft
- SeaLotusMITRE ATT&CK
Targets
Sectors: Government, Media
Regions: South East Asia, Vietnam
Source: MITRE ATT&CKKnown techniques
- T1003OS Credential Dumping
- T1003.001LSASS Memory
- T1012Query Registry
- T1016System Network Configuration Discovery
- T1018Remote System Discovery
- T1021.002SMB/Windows Admin Shares
- T1027.010Command Obfuscation
- T1027.011Fileless Storage
- T1027.013Encrypted/Encoded File
- T1027.016Junk Code Insertion
- T1033System Owner/User Discovery
- T1036Masquerading
- T1036.003Rename Legitimate Utilities
- T1036.004Masquerade Task or Service
- T1036.005Match Legitimate Resource Name or Location
- T1041Exfiltration Over C2 Channel
- T1046Network Service Discovery
- T1047Windows Management Instrumentation
- T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
- T1049System Network Connections Discovery
- T1053.005Scheduled Task
- T1055Process Injection
- T1056.001Keylogging
- T1059Command and Scripting Interpreter
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.005Visual Basic
- T1059.007JavaScript
- T1068Exploitation for Privilege Escalation
- T1070.004File Deletion
- T1070.006Timestomp
- T1071.001Web Protocols
- T1071.003Mail Protocols
- T1072Software Deployment Tools
- T1078.003Local Accounts
- T1082System Information Discovery
- T1083File and Directory Discovery
- T1087.001Local Account
- T1102Web Service
- T1105Ingress Tool Transfer
Malware and tools used
ArpCobalt StrikeDenisGoopyipconfigKerrdownKOMPROGOMimikatzNetnetshOSX_OCEANLOTUS.DPHOREALRotaJakiroSOUNDBITEWINDSHIELD
Source: MITRE ATT&CKRecent news
No stories yet.