{
  "name": "Adversary Atlas API",
  "version": "1.0.0",
  "description": "Read-only JSON API over the Adversary Atlas threat actor dataset. Statically generated at build time; no authentication, no rate limits.",
  "generated": "2026-07-31T01:06:07.226Z",
  "datasetCurrentAsOf": "2025-09-01",
  "license": "Data compiled from public primary sources; see /methodology/ for sourcing.",
  "actor": {
    "id": "apt32",
    "slug": "apt32",
    "name": "APT32",
    "shortName": "APT32",
    "country": "Vietnam",
    "countryCode": "VN",
    "sponsorship": "state-sponsored",
    "status": "active",
    "activeSince": "2014",
    "prominence": 74,
    "mitreGroupId": "G0050",
    "malpediaSlug": "apt32",
    "tagline": "Vietnamese collection against foreign firms operating in-country, regional neighbours, and dissidents abroad — with unusually elaborate web infrastructure.",
    "bio": "APT32, widely known as OceanLotus, conducts collection on behalf of Vietnamese state interests, with a target set that is commercially motivated as much as it is political.\n\nIts most distinctive characteristic is who it targets domestically: foreign companies operating in Vietnam, particularly in manufacturing, consumer products, hospitality, and automotive. Reporting has documented the group targeting the Vietnamese operations of multinational corporations in ways consistent with support for domestic industrial policy — collection that benefits Vietnamese firms competing with them.\n\nPolitically, the group targets regional governments across Southeast Asia — Cambodia, Laos, and the Philippines feature heavily — alongside dissidents, bloggers, and human rights activists in the Vietnamese diaspora.\n\nThe group built an unusually sophisticated web-based infrastructure for a mid-tier state actor. Volexity documented a network of more than a hundred websites, many impersonating legitimate Vietnamese news outlets, running selective profiling and exploitation frameworks that fingerprinted visitors and delivered payloads only to those matching a target profile — leaving ordinary visitors entirely unaffected and the infrastructure hard to detect from the outside.\n\nIn 2020 the group also targeted Chinese government entities involved in the COVID-19 response, seeking pandemic intelligence in the early weeks of the outbreak.",
    "attribution": {
      "sponsor": "Vietnam",
      "service": "Vietnamese state interests (specific service not publicly designated)",
      "confidence": "moderate",
      "summary": "Assessed as aligned with Vietnamese state interests by FireEye/Mandiant, Volexity, and ESET, based on targeting consistent with Vietnamese political and economic priorities, Vietnamese-language artifacts, and operational timing. No government has issued a formal attribution and no individuals have been indicted, making this a lower-confidence assessment than for Russian, Chinese, or DPRK groups.",
      "sources": [
        {
          "org": "Mandiant / FireEye",
          "title": "Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/cyber-espionage-apt32",
          "date": "2017-05-14"
        },
        {
          "org": "Volexity",
          "title": "OceanLotus: Extending Cyber Espionage Operations Through Fake Websites",
          "url": "https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/",
          "date": "2020-11-06"
        }
      ]
    },
    "motivations": [
      "espionage",
      "ip-theft"
    ],
    "targetSectors": [
      "Government",
      "Manufacturing",
      "Media & Journalism",
      "NGO & Civil Society",
      "Retail & Hospitality",
      "Technology",
      "Healthcare",
      "Financial Services",
      "Education"
    ],
    "targetCountries": [
      "Vietnam",
      "Cambodia",
      "Laos",
      "Philippines",
      "China",
      "Germany",
      "United States",
      "Japan"
    ],
    "aliases": [
      {
        "org": "mitre",
        "name": "APT32",
        "url": "https://attack.mitre.org/groups/G0050/",
        "correlation": "exact"
      },
      {
        "org": "microsoft",
        "name": "Canvas Cyclone",
        "correlation": "exact",
        "note": "Formerly BISMUTH"
      },
      {
        "org": "microsoft",
        "name": "BISMUTH",
        "correlation": "exact",
        "note": "Retired designator"
      },
      {
        "org": "crowdstrike",
        "name": "Ocean Buffalo",
        "correlation": "exact"
      },
      {
        "org": "mandiant",
        "name": "APT32",
        "correlation": "exact"
      },
      {
        "org": "secureworks",
        "name": "TIN WOODLAWN",
        "correlation": "exact"
      },
      {
        "org": "eset",
        "name": "OceanLotus",
        "correlation": "exact"
      },
      {
        "org": "kaspersky",
        "name": "OceanLotus",
        "correlation": "exact"
      },
      {
        "org": "cisa",
        "name": "APT32 / OceanLotus",
        "correlation": "exact"
      },
      {
        "org": "unit42",
        "name": "Sea Lotus",
        "correlation": "exact"
      }
    ],
    "tools": [
      {
        "name": "Cobalt Strike",
        "type": "framework",
        "custom": false,
        "description": "Heavily customised Beacon deployments with bespoke malleable C2 profiles."
      },
      {
        "name": "KerrDown",
        "type": "loader",
        "custom": true,
        "description": "Custom downloader delivered via malicious documents and installers, staging further payloads."
      },
      {
        "name": "Ratsnif",
        "type": "malware",
        "custom": true,
        "description": "Network packet manipulation tool supporting ARP poisoning, DNS spoofing, and HTTP injection."
      },
      {
        "name": "Denis / Salgorea",
        "type": "backdoor",
        "custom": true,
        "description": "Backdoor family using DNS tunnelling for C2, used against government targets."
      },
      {
        "name": "macOS OSX.OceanLotus",
        "type": "backdoor",
        "custom": true,
        "description": "macOS implant reflecting a target population with meaningful Mac usage in media and NGO sectors."
      },
      {
        "name": "Fake news websites",
        "type": "utility",
        "custom": true,
        "description": "Over 100 sites impersonating Vietnamese news outlets, profiling visitors and exploiting only those matching a target profile."
      }
    ],
    "techniques": [
      {
        "tCode": "T1189",
        "name": "Drive-by Compromise",
        "tactic": "Initial Access",
        "note": "Selective exploitation via a large network of impersonated news sites"
      },
      {
        "tCode": "T1566.001",
        "name": "Phishing: Spearphishing Attachment",
        "tactic": "Initial Access"
      },
      {
        "tCode": "T1608.004",
        "name": "Stage Capabilities: Drive-by Target",
        "tactic": "Resource Development",
        "note": "Profiling frameworks fingerprinting visitors before payload delivery"
      },
      {
        "tCode": "T1574.002",
        "name": "Hijack Execution Flow: DLL Side-Loading",
        "tactic": "Defense Evasion",
        "note": "Signed antivirus and productivity binaries used as loaders"
      },
      {
        "tCode": "T1218.011",
        "name": "System Binary Proxy Execution: Rundll32",
        "tactic": "Defense Evasion"
      },
      {
        "tCode": "T1557.001",
        "name": "Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning",
        "tactic": "Credential Access"
      },
      {
        "tCode": "T1071.004",
        "name": "Application Layer Protocol: DNS",
        "tactic": "Command and Control"
      },
      {
        "tCode": "T1102",
        "name": "Web Service",
        "tactic": "Command and Control"
      },
      {
        "tCode": "T1496",
        "name": "Resource Hijacking",
        "tactic": "Impact",
        "note": "Cryptomining deployed as a decoy to misdirect incident responders"
      },
      {
        "tCode": "T1547.001",
        "name": "Boot or Logon Autostart Execution: Registry Run Keys",
        "tactic": "Persistence"
      }
    ],
    "cves": [
      {
        "cveId": "CVE-2017-11882",
        "firstExploited": "2018-02-01",
        "usage": "Equation Editor overflow in lure documents delivering KerrDown against regional government targets.",
        "source": {
          "org": "Unit 42",
          "title": "Tracking OceanLotus' new Downloader, KerrDown",
          "url": "https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/",
          "date": "2019-02-01"
        }
      },
      {
        "cveId": "CVE-2017-0199",
        "firstExploited": "2017-06-01",
        "usage": "OLE2link RTF exploit used in phishing against corporate and government targets in Southeast Asia.",
        "source": {
          "org": "Mandiant / FireEye",
          "title": "Cyber Espionage is Alive and Well: APT32",
          "url": "https://cloud.google.com/blog/topics/threat-intelligence/cyber-espionage-apt32",
          "date": "2017-05-14"
        }
      }
    ],
    "relationships": [
      {
        "relatedActorId": "mustang-panda",
        "type": "operational-overlap",
        "confidence": "low",
        "note": "Competing regional collection interests across Southeast Asia; APT32 has targeted Chinese government entities directly."
      }
    ],
    "reports": [
      {
        "org": "Mandiant / FireEye",
        "title": "Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/cyber-espionage-apt32",
        "date": "2017-05-14"
      },
      {
        "org": "Volexity",
        "title": "OceanLotus: Extending Cyber Espionage Operations Through Fake Websites",
        "url": "https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/",
        "date": "2020-11-06"
      },
      {
        "org": "ESET",
        "title": "OceanLotus: macOS malware update",
        "url": "https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/",
        "date": "2019-04-09"
      }
    ],
    "campaigns": [
      {
        "id": "oceanlotus-websites",
        "actorId": "apt32",
        "name": "Fake News Website Network",
        "date": "2018-01-01",
        "endDate": "2020-11-01",
        "significance": "notable",
        "targetSectors": [
          "Media & Journalism",
          "NGO & Civil Society",
          "Government"
        ],
        "targetCountries": [
          "Vietnam",
          "Cambodia",
          "Laos",
          "Germany",
          "United States"
        ],
        "cveIds": [],
        "summary": "Over 100 websites impersonating legitimate Vietnamese news outlets, running profiling frameworks that fingerprinted visitors and delivered payloads only to those matching a target profile — leaving ordinary readers unaffected and the infrastructure difficult to detect externally.",
        "sources": [
          {
            "org": "Volexity",
            "title": "OceanLotus: Extending Cyber Espionage Operations Through Fake Websites",
            "url": "https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/",
            "date": "2020-11-06"
          }
        ]
      }
    ],
    "flag": "🇻🇳",
    "profile": "/apt/apt32/"
  }
}