APT32

Suspected state-linked cyber threat groupTrackedPending verification

Also known as: SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH

CyberVNM

Identification silhouette. Not drawn to scale between entries.

Fact cardConfidence · Source

System

TypeSuspected state-linked cyber threat group

Alternative designationsSeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH

ProliferationOrigin country only

Active since2014At least 2014Med^[1]

MITRE ATT&CK IDG0050High^[1]

Capabilities

ATT&CK techniques used78ATT&CK v20.1High^[1]

Malware and toolsArp, Cobalt Strike, Denis, Goopy, ipconfig, Kerrdown, KOMPROGO, Mimikatz, Net, netsh, OSX_OCEANLOTUS.D, PHOREAL, RotaJakiro, SOUNDBITE, WINDSHIELD15 malware and tool entries linked in ATT&CKHigh^[1]

Attribution and activity

Attributed sponsorSuspected Vietnam-based groupMed^[1]

TargetsThe group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia.Med^[1]

Notes

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.

Summary

Draft entry. Values come from the cited public sources and are awaiting editor verification.

Compare JSON

Operators

Vietnam

Sources

APT32, Group G0050, MITRE ATT&CK
Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08

Change log

2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G0050)