APT32

Origin🇻🇳 Vietnã

Techniques (MITRE ATT&CK)78

SourceMITRE ATT&CK

State sponsor: VietnamAttribution confidence: 50%Target categories: Government, Private sector, Civil society

Targeted regions: China · Germany · United States · Vietnam · Philippines · Association of Southeast Asian Nations

Also known as:APT-C-00ATK17BISMUTHCanvas CycloneCobalt KittyG0050Ocean BuffaloOcean LotusOceanLotusOceanLotus GroupPOND LOACHSea LotusSeaLotusTIN WOODLAWN

About the group

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity84

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 78

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Reconnaissance

Gather Victim Identity Information Email Addresses Spearphishing Link

Resource development

Domains Web Services Social Media Accounts Tool Upload Malware Drive-by Target

Initial access

Drive-by Compromise Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Software Deployment Tools Exploitation for Client Execution Malicious Link Malicious File Service Execution

Persistence

Office Application Startup Web Shell Windows Service Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation

Credential access

OS Credential Dumping LSASS Memory Credentials in Registry

Discovery

Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery System Information Discovery File and Directory Discovery Local Account Network Share Discovery

Lateral movement

SMB/Windows Admin Shares Pass the Hash Pass the Ticket Lateral Tool Transfer

Collection

Keylogging Archive Collected Data

Command and control

Web Protocols Mail Protocols Web Service Ingress Tool Transfer Non-Standard Port

Exfiltration

Exfiltration Over C2 Channel Exfiltration Over Unencrypted Non-C2 Protocol

defense-impairment

Modify Registry Linux and Mac Permissions Clear Windows Event Logs

Exploited vulnerabilities 2

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2017-11882HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2016-7255HIGHEPSS 81%KEV MITRE ATT&CK

Known infrastructure 2993

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port114.215.184.158:8000Cobalt Strikethreatfox

urlhttp://69.49.229.88:443/MQEwCobalt Strikethreatfox

ip:port154.12.17.20:8080Cobalt Strikethreatfox

ip:port154.12.17.20:22Cobalt Strikethreatfox

ip:port154.12.17.20:443Cobalt Strikethreatfox

ip:port154.12.17.20:80Cobalt Strikethreatfox

ip:port129.204.55.230:443Cobalt Strikethreatfox

ip:port47.94.56.71:8080Cobalt Strikethreatfox

ip:port47.94.56.71:80Cobalt Strikethreatfox

ip:port47.94.56.71:443Cobalt Strikethreatfox

ip:port45.227.253.132:8080Cobalt Strikethreatfox

ip:port45.227.253.132:80Cobalt Strikethreatfox

ip:port45.227.253.132:443Cobalt Strikethreatfox

ip:port45.227.253.132:32775Cobalt Strikethreatfox

ip:port117.158.148.164:65535Cobalt Strikethreatfox

ip:port38.76.190.209:8888Cobalt Strikethreatfox

ip:port188.227.14.105:8080Cobalt Strikethreatfox

ip:port186.241.115.168:12443Cobalt Strikethreatfox

ip:port109.206.247.245:10881Cobalt Strikethreatfox

ip:port43.134.112.45:7500Cobalt Strikethreatfox

ip:port43.134.112.45:7000Cobalt Strikethreatfox

ip:port43.134.112.45:80Cobalt Strikethreatfox

ip:port43.134.112.45:8080Cobalt Strikethreatfox

ip:port43.134.112.45:443Cobalt Strikethreatfox

ip:port43.134.112.45:22Cobalt Strikethreatfox

ip:port101.34.208.175:18317Cobalt Strikethreatfox

sha1_hash2ff26540ebb9100dae76a2ae040108ba9338113cCobalt Strikethreatfox

md5_hashe4a34372eab0832d0682fa986a8e0b97Cobalt Strikethreatfox

sha256_hash35afe2df347cb0909fdf2aba8ed6a506a681518a98c0a723b25a16957437f944Cobalt Strikethreatfox

sha256_hash224aec5fec1f907ce152895095f56a3a2f2db0d627633ee691af56a13f34e7f8Cobalt Strikethreatfox

+2993 indicators in total. See them all on the IOCs page.

References

APT32 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →