APT32

APT32, also known by aliases such as OceanLotus and Canvas Cyclone, is a Vietnamese state-sponsored cyber espionage group that has been active since at least 2013, primarily conducting intelligence gathering, intellectual property theft, and surveillance operations. The group's activities are consistently aligned with Vietnamese national interests, targeting foreign corporations with investments in Vietnam, as well as foreign governments, political dissidents, and journalists, particularly within Southeast Asia. APT32 is characterized by its sophisticated and adaptable operational methodology, often combining a unique suite of custom-developed malware, like WINDSHIELD and KOMPROGO, with commercially available penetration testing tools such as Cobalt Strike and Mimikatz. This hybrid approach underscores a well-resourced development capability and a capacity to continuously evolve its tactics to evade detection, setting it apart through its persistent focus on strategically relevant targets and its adeptness at employing diverse attack vectors.