aol.pm

APT32

IntrusionSet · ATTACK:enterprise:G0050

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0050",
  "title": "APT32",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0050",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--247cb30b-955f-42eb-97a5-a89fef69341e",
  "external_id": "G0050",
  "domain": "enterprise",
  "created": "2017-12-14T16:46:06.044Z",
  "modified": "2026-07-31T18:47:43.271Z",
  "version": "3.0",
  "aliases": [
    "APT32",
    "SeaLotus",
    "OceanLotus",
    "APT-C-00",
    "Canvas Cyclone",
    "BISMUTH"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "SeaLotus"
    },
    {
      "source_name": "APT-C-00"
    },
    {
      "source_name": "APT32"
    },
    {
      "source_name": "OceanLotus"
    },
    {
      "source_name": "Canvas Cyclone"
    },
    {
      "source_name": "BISMUTH"
    },
    {
      "source_name": "Amnesty Intl. Ocean Lotus February 2021",
      "url": "https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"
    },
    {
      "source_name": "FireEye APT32 May 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"
    },
    {
      "source_name": "Cybereason Oceanlotus May 2017",
      "url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt"
    },
    {
      "source_name": "ESET OceanLotus Mar 2019",
      "url": "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"
    },
    {
      "source_name": "ESET OceanLotus",
      "url": "https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"
    },
    {
      "source_name": "Volexity OceanLotus Nov 2017",
      "url": "https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    }
  ]
}

Explicit source assertions (93)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--032fb34d-3434-4667-9d5e-6bb9fd6b7d00

FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0743264d-1356-4f9e-96cc-8698f5e0e862

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d7c99f4-b1af-4278-b8bf-3bb04cce166d

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18771b0e-2d4b-4f76-ae1e-9cdac1c77cd0

Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18e8e653-d924-4fed-a33f-7893cf8a683b

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0100

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c01c64c-8842-44be-bd66-8355eb5d543c

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1072

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d3654f8-3a5e-4ef8-826f-4242ecf78c0a

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ecf4ac9-faad-4d2d-9a01-2618a7a54806

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eeb08cb-8b06-45a7-bf74-fb8bdaa4b02f

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1552.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--304f5c1b-7cfa-4c2a-b7a2-e4957da603b1

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0585

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3502b4bb-0e14-46b3-a92c-ba1c9d574259

Amnesty Intl. Ocean Lotus February 2021 · Unit 42 KerrDown February 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36af6d80-fef4-40b9-9b32-a2947eadd9e7

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1216.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f3f6df-5007-4075-84a3-9708132f1468

Twitter ItsReallyNick Status Update APT32 PubPrn

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a8d8063-3f4d-420d-8c72-2b99077aa487

ESET OceanLotus · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019 · FireEye APT32 April 2020 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c3f5cdb-f2cd-4bab-8196-26f160b38a5e

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40032198-f003-4171-92a0-faf038f62a0b

FireEye APT32 April 2020 · ESET OceanLotus · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4050ee68-3f26-49e6-beec-e2a62133a1c3

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43809fa9-dbe2-4429-875e-f0828563d6aa

ESET OceanLotus · ESET OceanLotus Mar 2019 · ESET OceanLotus macOS April 2019 · FireEye APT32 April 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45407caa-cfee-426d-a928-04db128b7ce8

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46144407-0f14-4358-8d4e-23b3ef13cb4e

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4683801a-abe8-4db2-88b9-ebbd2073bfeb

GitHub Invoke-Obfuscation · FireEye APT32 May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46e6fd22-1f0b-452c-bcf3-c24fe5911fd4

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46fa464b-20e0-4c77-9b75-580f9f236c43

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ef9490e-e347-4f4e-aa6f-c082e02349fc

FireEye APT32 May 2017 · Volexity OceanLotus Nov 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020 · Amnesty Intl. Ocean Lotus February 2021 · Unit 42 KerrDown February 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f13e788-b0da-457d-89b1-64196c9627b8

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0157

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55f58d30-b633-4094-97bb-6ab872c0f480

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0352

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56f587e1-d7c3-4489-945e-58c4ee3e4ba7

TrendMicro MacOS April 2018 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5758382a-2ada-4d05-ad25-8ee802a9e041

ESET OceanLotus · Cybereason Oceanlotus May 2017 · FireEye APT32 April 2020 · Volexity Ocean Lotus November 2020 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1598.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bc091f3-0059-4eab-ab68-5e4474108fdf

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0156

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ccd4b15-ef11-4b89-b0e1-4dd714fa2fb5

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d45479d-7cc2-49cc-8f10-5ead0a1db033

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f00edf9-fcfc-4514-8d06-bc69f91f9260

FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63835d80-f52b-472c-a605-b0360eea3539

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63994c7c-6544-4e29-9c94-ac2237166774

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1608.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c4a3ef5-8aee-4fe8-b2c6-386f90c057a4

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6dc0069c-5e6a-474f-946d-cc1cd13bc486

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f0b6cfd-ebe2-46f3-9be1-0075237dbcb9

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f75cf7f-1c21-4c22-983b-fac20ea85101

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70bc1a16-3c57-4198-b2f9-c7f27bec271c

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7133e850-c3f2-48c2-b610-22e3501354df

Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71a8ae5e-3a78-49b5-9857-e202d636cedf

FireEye APT32 May 2017 · ESET OceanLotus Mar 2019 · ESET OceanLotus macOS April 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1189

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72f9bf47-61ac-42c8-acbf-65be7c25af0f

ESET OceanLotus · Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--749fb1ed-d73c-4317-8c0f-6c059cff094f

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--768a6678-4823-4af5-bfd9-1a92c562b9f2

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76d2d007-1adb-4e04-8e79-dbd799ff57ef

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76ec3407-84df-4bc9-8679-09564ca9329e

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1560

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7723037f-0b2e-447b-811a-d18a109570bb

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--788a6ca2-60ac-4f36-b708-c3a57f087b2b

Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020 · Amnesty Intl. Ocean Lotus February 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79057890-3cd0-4124-8b35-b86db6b4f9d7

Volexity OceanLotus Nov 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e7d5aa9-6860-44fe-88b9-22a6b36162e2

Cybereason Cobalt Kitty 2017 · Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8029cccc-e198-4326-ac27-67b5968007ee

ESET OceanLotus macOS April 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8cc515c2-01b6-4cd7-a928-1131ffe5f11c

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93f1726f-f172-4705-a13a-d5adaeb4e91b

Volexity OceanLotus Nov 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98908617-068d-4b6e-bcba-ad213c137b1e

FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1036.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9932d0d8-ad06-4a4f-8acf-1502c2b5f009

Twitter ItsReallyNick APT32 pubprn Masquerade

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c97e0aa-61fd-4f42-881f-763a1b03c16b

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9cacb002-a04a-4779-997e-0cc9efaabda2

ESET OceanLotus · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ed7e90a-8034-48eb-8444-9ec29941a7b8

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a17eaa6b-8ef7-459e-a2e7-2d25e767370e

netlab360 rotajakiro vs oceanlotus

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1222.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4409632-996c-4f20-bdb0-a8e92c98307f

ESET OceanLotus macOS April 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a491cb90-9480-450b-9a57-55b95b249d31

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6080757-7935-439b-b70f-72ba841cda03

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1218.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7f5320a-dd76-4fa0-998f-44860ff1b307

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a933bad9-0f92-4a25-9b46-19120737caee

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aede5fa1-59de-40bf-92ca-15e317246f2d

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b019ea9e-afc4-4015-b690-677a09178feb

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0158

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb8fd9d4-4362-40c6-ab09-f05f843c2cef

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfa11036-022f-49b3-a6bd-7cf2083a264e

FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfdffc50-dba0-41d1-a332-0a02a0a8de07

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1550.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c08684c8-8467-4b7f-a9ac-3330cf423261

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1583.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c16c1ef2-2356-4987-bd9e-2cdaa007281a

Volexity Ocean Lotus November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7017855-dc52-4e9d-977f-3af701e094c8

Volexity OceanLotus Nov 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7bb75c5-c678-4ea7-b9ed-0c12c5de3077

ESET OceanLotus macOS April 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0099

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9660ab0-33d4-434d-833f-cc1969b04f7a

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbc1d2d8-aac7-498a-a034-f0a672977c11

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d57fba3a-0ed8-49a1-9446-13a4b73c3bc5

ESET OceanLotus Mar 2019 · ESET OceanLotus

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0155

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9c29485-ced4-4ebc-880c-31d35dd54b26

FireEye APT32 May 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db852d3d-7f78-43b9-bd14-3f2d11c22863

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db8530c2-ce41-4943-8a17-91502187fd06

FireEye APT32 May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db91e39d-daa4-4f9c-a7a6-be67eba712d2

GitHub Invoke-Obfuscation · FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017 · ESET OceanLotus Mar 2019 · ESET OceanLotus macOS April 2019 · ESET OceanLotus

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.