APT32

APT32, widely known as OceanLotus, conducts collection on behalf of Vietnamese state interests, with a target set that is commercially motivated as much as it is political.

Its most distinctive characteristic is who it targets domestically: foreign companies operating in Vietnam, particularly in manufacturing, consumer products, hospitality, and automotive. Reporting has documented the group targeting the Vietnamese operations of multinational corporations in ways consistent with support for domestic industrial policy — collection that benefits Vietnamese firms competing with them.

Politically, the group targets regional governments across Southeast Asia — Cambodia, Laos, and the Philippines feature heavily — alongside dissidents, bloggers, and human rights activists in the Vietnamese diaspora.

The group built an unusually sophisticated web-based infrastructure for a mid-tier state actor. Volexity documented a network of more than a hundred websites, many impersonating legitimate Vietnamese news outlets, running selective profiling and exploitation frameworks that fingerprinted visitors and delivered payloads only to those matching a target profile — leaving ordinary visitors entirely unaffected and the infrastructure hard to detect from the outside.

In 2020 the group also targeted Chinese government entities involved in the COVID-19 response, seeking pandemic intelligence in the early weeks of the outbreak.