Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)

ID: G0050

Associated Groups: SeaLotus, APT-C-00, OceanLotus, Canvas Cyclone, BISMUTH

Version: 3.0

Created: 14 Dec 2017

Last Modified: 17 Apr 2024

Name	Description
Associated Group Descriptions
SeaLotus	(Citation: Cybereason Oceanlotus May 2017)
APT-C-00	(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: Amnesty Intl. Ocean Lotus February 2021)
OceanLotus	(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: Amnesty Intl. Ocean Lotus February 2021)
Canvas Cyclone	(Citation: Microsoft Threat Actor Naming July 2023)
BISMUTH	(Citation: Microsoft Threat Actor Naming July 2023)

Domain	ID		Name	Use
Techniques Used
Enterprise	T1087	.001	Account Discovery: Local Account	APT32 enumerated administrative users using the commands `net localgroup administrators`.(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1583	.001	Acquire Infrastructure: Domains	APT32 has set up and operated websites to gather information and deliver malware.(Citation: Volexity Ocean Lotus November 2020)
		.006	Acquire Infrastructure: Web Services	APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.(Citation: Volexity Ocean Lotus November 2020)
Enterprise	T1071	.001	Application Layer Protocol: Web Protocols	APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.(Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Cobalt Kitty 2017)
		.003	Application Layer Protocol: Mail Protocols	APT32 has used email for C2 via an Office macro.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1547	.001	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)
Enterprise	T1059	.001	Command and Scripting Interpreter: PowerShell	APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
		.003	Command and Scripting Interpreter: Windows Command Shell	APT32 has used cmd.exe for execution.(Citation: Cybereason Cobalt Kitty 2017)
		.005	Command and Scripting Interpreter: Visual Basic	APT32 has used macros, COM scriptlets, and VBS scripts.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
		.007	Command and Scripting Interpreter: JavaScript	APT32 has used JavaScript for drive-by downloads and C2 communications.(Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)
Enterprise	T1543	.003	Create or Modify System Process: Windows Service	APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.(Citation: ESET OceanLotus)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)
Enterprise	T1585	.001	Establish Accounts: Social Media Accounts	APT32 has set up Facebook pages in tandem with fake websites.(Citation: Volexity Ocean Lotus November 2020)
Enterprise	T1048	.003	Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol	APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.(Citation: ESET OceanLotus Mar 2019)
Enterprise	T1222	.002	File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification	APT32's macOS backdoor changes the permission of the file it wants to execute to 755.(Citation: ESET OceanLotus macOS April 2019)
Enterprise	T1589	.002	Gather Victim Identity Information: Email Addresses	APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.(Citation: Amnesty Intl. Ocean Lotus February 2021)
Enterprise	T1564	.001	Hide Artifacts: Hidden Files and Directories	APT32's macOS backdoor hides the clientID file via a chflags function.(Citation: ESET OceanLotus macOS April 2019)
		.003	Hide Artifacts: Hidden Window	APT32 has used the WindowStyle parameter to conceal PowerShell windows. (Citation: FireEye APT32 May 2017) (Citation: Cybereason Cobalt Kitty 2017)
		.004	Hide Artifacts: NTFS File Attributes	APT32 used NTFS alternate data streams to hide their payloads.(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1574	.002	Hijack Execution Flow: DLL Side-Loading	APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)
Enterprise	T1070	.001	Indicator Removal: Clear Windows Event Logs	APT32 has cleared select event log entries.(Citation: FireEye APT32 May 2017)
		.004	Indicator Removal: File Deletion	APT32's macOS backdoor can receive a “delete” command.(Citation: ESET OceanLotus macOS April 2019)
		.006	Indicator Removal: Timestomp	APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.(Citation: FireEye APT32 May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)
Enterprise	T1056	.001	Input Capture: Keylogging	APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1036	.003	Masquerading: Rename System Utilities	APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.(Citation: Twitter ItsReallyNick APT32 pubprn Masquerade)
		.004	Masquerading: Masquerade Task or Service	APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".(Citation: FireEye APT32 May 2017)
		.005	Masquerading: Match Legitimate Name or Location	APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe. (Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)
Enterprise	T1003	.001	OS Credential Dumping: LSASS Memory	APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1027	.001	Obfuscated Files or Information: Binary Padding	APT32 includes garbage code to mislead anti-malware software and researchers.(Citation: ESET OceanLotus)(Citation: ESET OceanLotus Mar 2019)
		.010	Obfuscated Files or Information: Command Obfuscation	APT32 has used the `Invoke-Obfuscation` framework to obfuscate their PowerShell.(Citation: FireEye APT32 May 2017)(Citation: GitHub Invoke-Obfuscation)(Citation: Cybereason Cobalt Kitty 2017)
		.011	Obfuscated Files or Information: Fileless Storage	APT32's backdoor has stored its configuration in a registry key.(Citation: ESET OceanLotus Mar 2019)
		.013	Obfuscated Files or Information: Encrypted/Encoded File	APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.(Citation: FireEye APT32 May 2017)(Citation: GitHub Invoke-Obfuscation)(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)
Enterprise	T1588	.002	Obtain Capabilities: Tool	APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)
Enterprise	T1566	.001	Phishing: Spearphishing Attachment	APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: FireEye APT32 April 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)
		.002	Phishing: Spearphishing Link	APT32 has sent spearphishing emails containing malicious links.(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: FireEye APT32 April 2020)(Citation: Volexity Ocean Lotus November 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)
Enterprise	T1598	.003	Phishing for Information: Spearphishing Link	APT32 has used malicious links to direct users to web pages designed to harvest credentials.(Citation: Volexity Ocean Lotus November 2020)
Enterprise	T1021	.002	Remote Services: SMB/Windows Admin Shares	APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1053	.005	Scheduled Task/Job: Scheduled Task	APT32 has used scheduled tasks to persist on victim systems.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)
Enterprise	T1505	.003	Server Software Component: Web Shell	APT32 has used Web shells to maintain access to victim websites.(Citation: Volexity OceanLotus Nov 2017)
Enterprise	T1608	.001	Stage Capabilities: Upload Malware	APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.(Citation: Volexity Ocean Lotus November 2020)
		.004	Stage Capabilities: Drive-by Target	APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.(Citation: Volexity Ocean Lotus November 2020)
Enterprise	T1218	.005	System Binary Proxy Execution: Mshta	APT32 has used mshta.exe for code execution.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
		.010	System Binary Proxy Execution: Regsvr32	APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.(Citation: ESET OceanLotus Mar 2019)(Citation: FireEye APT32 May 2017)(Citation: Cybereason Cobalt Kitty 2017)
		.011	System Binary Proxy Execution: Rundll32	APT32 malware has used rundll32.exe to execute an initial infection process.(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1216	.001	System Script Proxy Execution: PubPrn	APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.(Citation: Twitter ItsReallyNick Status Update APT32 PubPrn)
Enterprise	T1569	.002	System Services: Service Execution	APT32's backdoor has used Windows services as a way to execute its malicious payload. (Citation: ESET OceanLotus Mar 2019)
Enterprise	T1552	.002	Unsecured Credentials: Credentials in Registry	APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1550	.002	Use Alternate Authentication Material: Pass the Hash	APT32 has used pass the hash for lateral movement.(Citation: Cybereason Cobalt Kitty 2017)
		.003	Use Alternate Authentication Material: Pass the Ticket	APT32 successfully gained remote access by using pass the ticket.(Citation: Cybereason Cobalt Kitty 2017)
Enterprise	T1204	.001	User Execution: Malicious Link	APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.(Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)
		.002	User Execution: Malicious File	APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: FireEye APT32 April 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)
Enterprise	T1078	.003	Valid Accounts: Local Accounts	APT32 has used legitimate local admin account credentials.(Citation: FireEye APT32 May 2017)

ID	Name	References	Techniques
Software
S0039	Net	(Citation: Cybereason Cobalt Kitty 2017) (Citation: Microsoft Net Utility) (Citation: Savill 1999)	Password Policy Discovery, Domain Groups, System Time Discovery, Domain Account, Local Account, System Service Discovery, Remote System Discovery, Network Share Discovery, System Network Connections Discovery, Network Share Connection Removal, Service Execution, Local Account, Additional Local or Domain Groups, Local Groups, SMB/Windows Admin Shares, Domain Account
S1078	RotaJakiro	(Citation: netlab360 rotajakiro vs oceanlotus) (Citation: RotaJakiro 2021 netlab360 analysis)	Deobfuscate/Decode Files or Information, Unix Shell Configuration Modification, Native API, Standard Encoding, Boot or Logon Initialization Scripts, System Information Discovery, Systemd Service, Shared Modules, Non-Standard Port, Non-Application Layer Protocol, Match Legitimate Name or Location, Inter-Process Communication, Process Discovery, Automated Collection, XDG Autostart Entries, Exfiltration Over C2 Channel, Symmetric Cryptography
S0100	ipconfig	(Citation: Cybereason Cobalt Kitty 2017) (Citation: TechNet Ipconfig)	System Network Configuration Discovery
S0099	Arp	(Citation: Cybereason Cobalt Kitty 2017) (Citation: TechNet Arp)	Remote System Discovery, System Network Configuration Discovery
S0108	netsh	(Citation: Cybereason Cobalt Kitty 2017) (Citation: TechNet Netsh)	Disable or Modify System Firewall, Netsh Helper DLL, Proxy, Security Software Discovery
S0156	KOMPROGO	(Citation: FireEye APT32 May 2017)	System Information Discovery, Windows Management Instrumentation, Windows Command Shell
S0585	Kerrdown	(Citation: Amnesty Intl. Ocean Lotus February 2021) (Citation: Unit 42 KerrDown February 2019)	Spearphishing Link, Visual Basic, Spearphishing Attachment, Obfuscated Files or Information, System Information Discovery, DLL Side-Loading, Ingress Tool Transfer, Lateral Tool Transfer, Deobfuscate/Decode Files or Information, Malicious File, Malicious Link
S0155	WINDSHIELD	(Citation: FireEye APT32 May 2017)	Custom Command and Control Protocol, Non-Application Layer Protocol, System Owner/User Discovery, Query Registry, System Information Discovery, File Deletion
S0157	SOUNDBITE	(Citation: FireEye APT32 May 2017)	System Information Discovery, Modify Registry, DNS, Application Window Discovery, File and Directory Discovery
S0154	Cobalt Strike	(Citation: Amnesty Intl. Ocean Lotus February 2021) (Citation: cobaltstrike manual) (Citation: Cybereason Cobalt Kitty 2017) (Citation: Cybereason Oceanlotus May 2017) (Citation: FireEye APT32 May 2017) (Citation: Unit 42 KerrDown February 2019) (Citation: Volexity Ocean Lotus November 2020) (Citation: Volexity OceanLotus Nov 2017)	Domain Fronting, Sudo and Sudo Caching, Code Signing, Scheduled Transfer, JavaScript, Remote Desktop Protocol, Native API, Pass the Hash, Domain Accounts, Indicator Removal from Tools, Bypass User Account Control, System Network Configuration Discovery, Service Execution, PowerShell, Web Protocols, Application Layer Protocol, Data from Local System, Disable or Modify Tools, Dynamic-link Library Injection, Local Accounts, Multiband Communication, Keylogging, Distributed Component Object Model, Process Discovery, BITS Jobs, Process Hollowing, Software Discovery, Local Accounts, BITS Jobs, Remote Desktop Protocol, Internal Proxy, Exploitation for Privilege Escalation, Screen Capture, Process Argument Spoofing, Modify Registry, Domain Groups, System Network Connections Discovery, Protocol or Service Impersonation, Parent PID Spoofing, Token Impersonation/Theft, Protocol Tunneling, Windows Service, Visual Basic, Native API, Parent PID Spoofing, Process Injection, System Service Discovery, Timestomp, System Network Configuration Discovery, SSH, File and Directory Discovery, DNS, Token Impersonation/Theft, DNS, Bypass User Account Control, Process Hollowing, Scheduled Transfer, Security Account Manager, Local Groups, PowerShell, SSH, Python, Reflective Code Loading, Remote System Discovery, LSASS Memory, Screen Capture, Commonly Used Port, Query Registry, Domain Account, Data Transfer Size Limits, Network Service Discovery, Pass the Hash, Domain Accounts, Network Share Discovery, Web Protocols, Asymmetric Cryptography, Windows Command Shell, Process Injection, Browser Session Hijacking, Deobfuscate/Decode Files or Information, Remote System Discovery, Visual Basic, Protocol Tunneling, Exploitation for Privilege Escalation, Windows Management Instrumentation, Keylogging, Browser Session Hijacking, Windows Remote Management, Symmetric Cryptography, Non-Application Layer Protocol, Standard Encoding, Ingress Tool Transfer, Indicator Removal from Tools, Domain Account, Internal Proxy, Service Execution, Windows Remote Management, SMB/Windows Admin Shares, Rundll32, Windows Service, File Transfer Protocols, Python, SMB/Windows Admin Shares, Windows Management Instrumentation, Security Account Manager, Make and Impersonate Token, Exploitation for Client Execution, Network Service Discovery, Timestomp, Distributed Component Object Model, Multiband Communication, Commonly Used Port, Network Share Discovery, Custom Command and Control Protocol, Process Discovery, Make and Impersonate Token, Data from Local System, Office Template Macros, Windows Command Shell, Obfuscated Files or Information
S0002	Mimikatz	(Citation: Adsecurity Mimikatz Guide) (Citation: Cybereason Cobalt Kitty 2017) (Citation: Cybereason Oceanlotus May 2017) (Citation: Deply Mimikatz) (Citation: FireEye APT32 May 2017)	DCSync, Credentials from Password Stores, Rogue Domain Controller, Private Keys, SID-History Injection, Security Support Provider, Pass the Hash, Account Manipulation, Pass the Ticket, Credentials from Web Browsers, Golden Ticket, Security Account Manager, LSASS Memory, Silver Ticket, Windows Credential Manager, Steal or Forge Authentication Certificates, LSA Secrets
S0352	OSX_OCEANLOTUS.D	(Citation: Amnesty Intl. Ocean Lotus February 2021) (Citation: Backdoor.MacOS.OCEANLOTUS.F) (Citation: Trend Micro MacOS Backdoor November 2020) (Citation: TrendMicro MacOS April 2018) (Citation: Unit42 OceanLotus 2017)	Encrypted/Encoded File, Non-Application Layer Protocol, Linux and Mac File and Directory Permissions Modification, File Deletion, System Network Configuration Discovery, System Checks, Symmetric Cryptography, Deobfuscate/Decode Files or Information, Unix Shell, System Information Discovery, Non-Standard Port, Launch Agent, Ingress Tool Transfer, Visual Basic, Hidden Files and Directories, Timestomp, Web Protocols, Standard Encoding, Launch Daemon, Software Packing, Archive via Library, Masquerade Task or Service, Data from Local System, Archive via Custom Method, Shared Modules, Gatekeeper Bypass, PowerShell, Masquerade File Type
S0477	Goopy	(Citation: Cybereason Cobalt Kitty 2017)	DNS, Visual Basic, Indicator Removal, Obfuscated Files or Information, Windows Command Shell, System Owner/User Discovery, Disable or Modify Tools, Web Protocols, Process Discovery, Clear Mailbox Data, Data from Local System, Native API, Mail Protocols, Deobfuscate/Decode Files or Information, DLL Side-Loading, Exfiltration Over C2 Channel, Match Legitimate Name or Location, Scheduled Task, Binary Padding
S0354	Denis	(Citation: Cybereason Cobalt Kitty 2017) (Citation: Cybereason Oceanlotus May 2017)	DNS, File Deletion, System Checks, Ingress Tool Transfer, Process Hollowing, System Information Discovery, Query Registry, Deobfuscate/Decode Files or Information, Command Obfuscation, System Network Configuration Discovery, Standard Encoding, Archive via Library, Hijack Execution Flow, File and Directory Discovery, Native API, PowerShell, System Owner/User Discovery, DLL Side-Loading, Obfuscated Files or Information, Windows Command Shell
S0158	PHOREAL	(Citation: FireEye APT32 May 2017)	Modify Registry, Custom Command and Control Protocol, Windows Command Shell, Non-Application Layer Protocol

References

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

APT32

Associated Group Descriptions

Techniques Used

Software

References