OCEANLOTUS GROUP (APT32): ESPIONAGE CAMPAIGNS TARGETING GOVERNMENT INFRASTRUCTURE IN SOUTHEAST ASIA

Threat Researcher: Mohammad Heading Nor Ilahi, CTIA, CEH, ISO 29147 VD

EXECUTIVE SUMMARY

This report documents an espionage campaign attributed with high confidence to the OceanLotus Group (APT32), a long-running, state-aligned threat actor linked to Vietnam. This analysis focuses on observed activity targeting strategic government entities in Southeast Asia, using a recent incident involving the Indonesian government as a key data point.

RiskIQ’s Team Atlas Microsoft identified the core vulnerability as the likely compromise and exfiltration of SSL certificates associated with the Indonesian Government domains. This critical key material is subsequently suspected of being deployed on attacker-controlled infrastructure for sophisticated Man-in-the-Middle (MITM) operations or credential harvesting against other government entities and partners.

The intelligence is substantiated by the recovery of tailor-made lure documents in the Indonesian language, including materials related to sensitive government functions, confirming targeted reconnaissance and espionage intent within the region. APT32’s operational history underscores a consistent focus on intelligence collection that aligns with Vietnam’s strategic, political, and economic interests across the ASEAN region.

KEY FINDINGS | DETAILS

• Impact | Exfiltration of SSL certificate private keys for key Indonesian government domains.
• Critical Hash | Stolen Certificate SHA1 Hash: 0cd1323448bc12df69a62587740b7bfa5d9946db.
• Lure Evidence | Malicious documents were highly contextual, in the Indonesian language, and focused on sensitive technical and policy planning documents.
• Attribution Confidence | High, based on historical TTP overlap (ActiveMime lures, Scheduled Task persistence) and regional targeting.

THREAT ACTOR PROFILE & VICTIMOLOGY

OceanLotus Group Profile

Metadata | Details

• Aliases | APT32, Cobalt Kitty, SeaLotus, BISMUTH, Canvas Cyclone
• Nexus | Vietnam
• Motivation | Cyber Espionage, Intelligence Collection, and Strategic Information Theft.
• Primary Target Sectors | Government, Defense, Manufacturing, Hospitality, Technology Infrastructure, Media, and Dissident/NGO groups.

Regional Targeting Pattern

APT32’s victimology demonstrates a clear strategic focus on Southeast Asian nations, reflecting state-level priorities:

• Governments: Targeted nations include Indonesia (SSL compromise incident), the Philippines (government employees), Cambodia, and Laos.
• Economic Targets: Foreign corporations with significant investments or operations in Vietnam across the manufacturing, consumer products, and hospitality sectors.
• Civil Society: Consistent surveillance and espionage against Vietnamese dissidents, journalists, and human rights NGOs, often utilizing sophisticated Strategic Web Compromises.

The current compromise of Indonesian government certificates aligns perfectly with this historical pattern of targeting sovereign governments within the region to acquire political and strategic intelligence.

STAGE 1: INITIAL ACCESS & TRACKING

Initial Access Methods

APT32 employs diverse, multi-pronged approaches for initial access, typically tailored to the target:

• Spearphishing Attachments (T1566.001): The primary vector involves ActiveMime files (MHT format) disguised as benign documents with a .doc extension. The file often presents a social engineering lure such as a fake "text encoding error" to panic the victim into manually enabling malicious macros, initiating the infection chain.
• Strategic Web Compromise (T1585): The group is known for compromising websites frequented by targets (watering holes). These sites are injected with malicious JavaScript to profile visitors or deliver a payload, sometimes masked as a legitimate software update (MITRE, 2024).

Example of APT32’s social engineering lure: A fake error message designed to trick the victim into enabling macros.

Operational Tracking

A key element of APT32’s tradecraft is its redundant campaign tracking system:

Embedded HTML Tag: The ActiveMime lure often contains an embedded HTML Image Tag linking to an external resource hosted on APT32 infrastructure. Critically, Microsoft Word attempts to download this image even if macros are disabled, allowing the actor to monitor web logs and confirm the victim’s public IP address, validating the target acquisition prior to code execution.

Phishing lure content illustrating the hidden HTML Image Tag used for victim IP confirmation.

STAGE 2: EXECUTION, PERSISTENCE & EVASION

Execution and Persistence

APT32 leverages Windows-native components to establish deep persistence:

• Scheduled Task Persistence (T1053.005): The infection chain culminates in the creation of two specific scheduled tasks that launch backdoors:

1. “Windows Scheduled Maintenance”: Runs a COM scriptlet (utilizing an Application Whitelisting bypass) to dynamically download and inject the first-stage payload (often Cobalt Strike BEACON) into memory.
2. “Scheduled Defrags”: Downloads and executes a secondary, custom APT32 backdoor via a multi-stage PowerShell script.

• Registry-Based Persistence (T1546.015): Newer reporting indicates the use of registry-based COM persistence to ensure long-term, low-profile access, bypassing file-based detection (Brandefense, 2025).

The ActiveMIME MHT Lures Attack Lifecycle, mapping initial delivery through execution and post-exploitation persistence.

Defense Evasion Techniques

• System Masquerading (T1036.002): The group uses hidden or non-printing Unicode characters to visually disguise malicious file and service names, complicating manual detection by security analysts.
• Log Clearing (T1070.001): APT32 regularly deletes specific system event log entries immediately after gaining access, covering their initial tracks.
• Trusted Infrastructure Abuse (T1588.005): Payloads are frequently hosted on trusted cloud services (Dropbox, Google Drive) or previously compromised legitimate network security infrastructure (e.g., McAfee ePO) to evade perimeter filtering.

MALWARE CAPABILITIES

APT32 utilizes a modular and adaptable toolset, featuring custom backdoors and commercial tools configured for stealth.

• MALWARE NAME | C2 PROTOCOL | CORE CAPABILITIES WINDSHIELD | TCP raw sockets | Registry manipulation, system reconnaissance, file system interaction, anti-disassembly features. -KOMPROGO / SOUNDBITE | DNS | Full-featured backdoor: process/file management, reverse shell creation, WMI queries. -PHOREAL | ICMP | Shell command execution, file upload, system enumeration, capable of establishing a reverse shell. -BEACON (Cobalt Strike) | Configurable Malleable C2 | Commercial post-exploitation framework used for code injection and lateral movement.

INDICATORS OF COMPROMISE (IoCs)

The following IoCs are associated with APT32 operations.

INDICATOR TYPE | CONTEXT | VALUE File Hash (MD5) | ActiveMime Lure Example | 5458a2e4d784abb1a1127263bd500665 File Hash (MD5) | ActiveMime Lure Example | 4f761095ca51bfbbf4496a4964e41d4f IP Address | Cobalt Strike BEACON C2 | 80[.]255[.]3[.]87 Domain | Meterpreter Host | images[.]chinabytes[.]info Domain | APT32 C2 | blog[.]panggin[.]org URL (Tracking) | Phishing Success Tracking Mechanism | [http://job[.]supperpow[.]com:80/pd/fans/mitsumi/a550[.]jpg](http://job[.]supperpow[.]com:80/pd/fans/mitsumi/a550[.]jpg)

RECOMMENDATIONS

Proactive Defenses Against APT32 TTPs

• Application Control: Implement rigorous whitelisting policies to prevent the execution of malicious scripts via legitimate Windows processes (PowerShell, wscript, cscript).
• EDR Hunting: Configure EDR solutions to actively hunt for persistence mechanisms utilized by APT32, specifically the creation of suspicious scheduled tasks (e.g., “Windows Scheduled Maintenance”) and the use of registry-based persistence techniques.
• Phishing Training: Conduct targeted security awareness training focused on recognizing ActiveMime lures and the deceptive social engineering tactics used by this actor group.

REFERENCES

• https://cloud.google.com/blog/topics/threat-intelligence/cyber-espionage-apt32
• https://attack.mitre.org/groups/G0050/
• https://cloud.google.com/blog/topics/threat-intelligence/apt32-targeting-chinese-government-in-covid-19-related-espionage/
• https://brandefense.io/blog/apt32-targeting-ngos-2025/
• https://www.obsidiansecurity.com/incident-watch/apt32-targets-dissidents-and-corporate-media-via-fake-site-espionage-campaign