APT32 (G0050) | Threat Actor Index

78

Techniques

15

Toolsets

0

CVEs Referenced

0

KEV Entries

About APT32

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.

View MITRE record ↗

Techniques by Tactic (78)

Reconnaissance

T1589 Gather Victim Identity InformationT1589.002 Email AddressesT1598.003 Spearphishing Link

Resource Development

T1583.001 DomainsT1583.006 Web ServicesT1585.001 Social Media AccountsT1588.002 ToolT1608.001 Upload MalwareT1608.004 Drive-by Target

Initial Access

T1078.003 Local AccountsT1189 Drive-by CompromiseT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1072 Software Deployment ToolsT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious FileT1569.002 Service ExecutionT1574.001 DLL

Persistence

T1053.005 Scheduled TaskT1078.003 Local AccountsT1112 Modify RegistryT1137 Office Application StartupT1505.003 Web ShellT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1053.005 Scheduled TaskT1055 Process InjectionT1068 Exploitation for Privilege EscalationT1078.003 Local AccountsT1543.003 Windows ServiceT1547.001 Registry Run Keys / Startup Folder

Defence Impairment

T1112 Modify RegistryT1222.002 Linux and Mac PermissionsT1685.005 Clear Windows Event Logs

Credential Access

T1003 OS Credential DumpingT1003.001 LSASS MemoryT1056.001 KeyloggingT1552.002 Credentials in Registry

Discovery

T1012 Query RegistryT1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1135 Network Share Discovery

Lateral Movement

T1021.002 SMB/Windows Admin SharesT1072 Software Deployment ToolsT1550.002 Pass the HashT1550.003 Pass the TicketT1570 Lateral Tool Transfer

Collection

T1056.001 KeyloggingT1560 Archive Collected Data

Command & Control

T1071.001 Web ProtocolsT1071.003 Mail ProtocolsT1102 Web ServiceT1105 Ingress Tool TransferT1571 Non-Standard Port

Exfiltration

T1041 Exfiltration Over C2 ChannelT1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Toolsets (15)

🐛

Cobalt Strike S0154

Malware · Linux, macOS, Windows

🐛

Denis S0354

Malware · Windows

🐛

Goopy S0477

Malware · Windows

🐛

KOMPROGO S0156

Malware · Windows

🐛

Kerrdown S0585

Malware · Windows

🐛

OSX_OCEANLOTUS.D S0352

Malware · macOS

🐛

PHOREAL S0158

Malware · Windows

🐛

RotaJakiro S1078

Malware · Linux

🐛

SOUNDBITE S0157

Malware · Windows

🐛

WINDSHIELD S0155

Malware

🔧

Arp S0099

Tool · Linux, Windows, macOS

🔧

Mimikatz S0002

Tool · Windows

🔧

Net S0039

Tool · Windows

🔧

ipconfig S0100

Tool

🔧

netsh S0108

Tool · Windows

References & Reports (7)

↑