Skip to content
Sign in

Threat actor · MITRE ATT&CK G0050

OceanLotus

Alert

Vietnam · espionage · also tracked as APT32, APT-C-00, ATK17

Tracked by CyberSIXT since 6 May · RSS

2Articles, all time
0Articles, last 30 days
0CVEs exploited, attributed · all time
4Research reports, all time

Activity

Full timeline
Quiet for 22 weekslast report 11 Jun2 articles2 outlets4 reports

Two articles so far, 6 May to 11 Jun.

Now6 Apr15212726111621272611Earliest drawnSecurelist · 6 MayResearch reportcocomelonc.github.io · 19 May
  • Thu 11 Jun. The Hacker News. OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack.
  • Tue 19 May. Research report by cocomelonc.github.io. MacOS malware persistence 11: osascript LOLBin. Simple C example.
  • Thu 7 May. Research report by Kaspersky. Securelist | Kaspersky’s threat research and reports.
  • Wed 6 May. Securelist. OceanLotus behind ZiChatBot malware in PyPI wheel packages.
  • Fri 10 Apr. Research report by Check Point. Deobfuscating APT32 Flow Graphs with Cutter and Radare2.
  • Mon 6 Apr. Research report by MITRE ATT&CK. Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise.
  • Article naming OceanLotus
  • Square: research report
  • Articles a day, all coverage
  • Quiet time, folded

Drawn: all 2 articles and all 4 research reports.

Show as table
OceanLotus: drawn articles and research reports
DateTypeSourceTitle
11 JunArticleThe Hacker NewsOceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack
19 MayReportcocomelonc.github.ioMacOS malware persistence 11: osascript LOLBin. Simple C example
7 MayReportKasperskySecurelist | Kaspersky’s threat research and reports
6 MayArticleSecurelistOceanLotus behind ZiChatBot malware in PyPI wheel packages
10 AprReportCheck PointDeobfuscating APT32 Flow Graphs with Cutter and Radare2
6 AprReportMITRE ATT&CKServer Software Component: Web Shell, Sub-technique T1505.003 - Enterprise

Connections

33 tools. What the record links this actor to; hover or use the arrow keys.

Show as a list
Malware and tools
MimiKatz, Net, Arp, ipconfig, netsh, Cobalt Strike, WINDSHIELD, KOMPROGO, SOUNDBITE, PHOREAL

CVEs exploited

No CVE is attributed to OceanLotus in CyberSIXT coverage.

MITRE ATT&CK techniques78 techniques · 14 tactics

Distinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.

Compare withAverage of 48 actors
Click a shape or a legend entry to select it.
Show as table
Distinct ATT&CK techniques per tactic
TacticOceanLotusAverage of 48 actors
Reconnaissance32.2
Resource Development64.9
Initial Access43.3
Execution135.7
Persistence74.4
Privilege Escalation63.7
Stealth207.9
Defense Impairment31.5
Credential Access43.1
Discovery105.9
Lateral Movement51.5
Collection23.1
Command and Control54
Exfiltration20.9
Impact01.1

Most recorded: Stealth 20 · Execution 13 · Discovery 10

Show the technique matrix90 techniques

Reconnaissance3

Resource Development6

Initial Access4

Execution13

Persistence7

Privilege Escalation6

Stealth20

Defense Impairment3

Credential Access4

Discovery10

Lateral Movement5

Collection2

Command and Control5

Exfiltration2

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

Malware and tools33

MITRE ATT&CK® · G0050 and Malpedia · apt32

Articles2

Drawn: all 2 articles and all 4 research reports.

Search every article
Include passing mentions (2)
CyberSIXTSignal over noise
Updated AboutDevelopersSign in