Lurking for 4 years! APT32 continues to attack Asian organisations

▌APT32 Attacks Vietnam-Related Organizations to Steal Information

Diagram of persistence mechanisms on Host 1

The threat group APT32 has been found to continuously attack various organizations in Asia in recent years. This threat group is also known by names such as APT-C-00, Canvas Cyclone (formerly known as Bismuth), Cobalt Kitty, and OceanLotus. It is a hacking group with close ties to Vietnam. It is estimated that this series of intrusion activities has been carried out quietly for at least four years.

In-depth analysis reveals that the tactics of this intrusion significantly overlap with the attack strategies previously adopted by APT32/OceanLotus, and the target groups are also highly consistent with the consistent preferences of APT32/OceanLotus. Since 2012, OceanLotus has been active in cyberspace, specifically targeting corporate and government networks in East Asian countries, primarily for the purposes of cyber espionage and stealing valuable intellectual property. This series of actions not only poses a serious threat to the cybersecurity of these countries but also highlights the complexity and covertness of transnational cyber criminal activities.

▌Multi-method Deployment of Backdoors to Steal Sensitive Data

The attack chain often employs spear-phishing lures as an initial penetration method to deploy backdoors capable of executing arbitrary shellcode and gathering sensitive data. Notably, the group was found to implement "watering hole" attacks as early as 2018, aiming to infect website visitors, deliver reconnaissance payloads to them, or steal their login credentials.

In response to other recent series of attack incidents, analysis involved four hosts, each of which was compromised and configured with multiple scheduled tasks and Windows Registry keys. These settings were used to launch Cobalt Strike Beacons (a backdoor capable of stealing Google Chrome browser cookies for all users on the system) and loaders for loading embedded DLL payloads.

Additionally, South Korean users are currently facing an ongoing attack campaign that likely utilizes spear-phishing and vulnerable Microsoft Exchange servers to deliver reverse shells, backdoors, and VNC malware to gain control of compromised devices and steal credentials stored in web browsers.

▌APT32 Persistent Threat: Strengthening Defense Mechanisms against Sophisticated Cyber Attacks

The persistent attack activities of the APT32/OceanLotus group not only highlight the severity of cyber threats but also serve as a reminder to all organizations, especially non-profit organizations and government entities, that they must remain highly vigilant and strengthen their cybersecurity defenses. By employing an advanced security metrics validation platform to simulate and test defenses against specific threat groups, weak points in the security architecture can be effectively identified and reinforced. At the same time, raising awareness of common tactics such as spear-phishing and watering hole attacks, timely patching of systems, and preventing attacks exploiting known vulnerabilities are indispensable measures for protecting sensitive data and user privacy. Facing evolving cyber threats, building multi-layered defense mechanisms to achieve rapid threat response and mitigation is key to ensuring organizational cybersecurity.

▌Lexfo Security Validation Rules

In response to the attack methods employed by this hacking group, the Lexfo Security Metrics Validation Platform has timely incorporated corresponding attack simulation rules. You only need to search for the keyword "APT32" within the platform to obtain attack simulation validation actions closely related to this threat group. With these carefully designed simulated attacks, you can comprehensively assess and validate whether your security defense system has the capability to effectively defend against APT32 group attacks. The Lexfo Security Metrics Validation Platform employs an industry-unique method to ensure your validation process is safe and harmless.