APT32

Overview

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

Naming & attribution

APT32 is tracked under 6 names across the industry. It uses 78 documented ATT&CK techniques — more than 95% of the 174 groups tracked here. Activity attributed since at least 2014.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1216.001 PubPrn — used by 1 of 174 groups
• T1564.004 NTFS File Attributes — used by 1 of 174 groups
• T1027.011 Fileless Storage — used by 2 of 174 groups
• T1137 Office Application Startup — used by 2 of 174 groups
• T1222.002 Linux and Mac Permissions — used by 3 of 174 groups
• T1550.003 Pass the Ticket — used by 3 of 174 groups
• T1552.002 Credentials in Registry — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Lazarus Group North Korea — 42 shared techniques (33% overlap)
• Mustang Panda China — 40 shared techniques (33% overlap)
• Magic Hound Iran — 39 shared techniques (33% overlap)
• Sandworm Team Russia — 35 shared techniques (29% overlap)
• Threat Group-3390 China — 30 shared techniques (29% overlap)
• Kimsuky North Korea — 45 shared techniques (28% overlap)

Targets

Civil society · Dissidents · Government · Journalists · Private sector

Regions

Association of Southeast Asian Nations · China · Germany · Philippines · United States · Vietnam

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203
• Custom malware/implant development — ATT&CK: 10 attributed custom malware families

TTPs — 78 techniques across 14 tactics

Tools & malware (15)

Mimikatz · ipconfig · Kerrdown · Cobalt Strike · SOUNDBITE · OSX_OCEANLOTUS.D · KOMPROGO · netsh · RotaJakiro · PHOREAL · Arp · WINDSHIELD · Denis · Net · Goopy

Reporting (3)

• How Microsoft names threat actors — Microsoft
• Vietnamese activists targeted by notorious hacking group — Amnesty International
• Fake or Fake: Keeping up with OceanLotus decoys — Dumont, R