Affected Vietnamese Human Rights Organization Subjected to Long-Term Cyber Breach by APT32
An organization advocating for Vietnamese human rights has become the focus of a sustained plan aimed at distributing a range of malware on infiltrated systems.
The cybersecurity firm Huntress linked the operation to a hacker group identified as APT32, a Vietnam-centered hacking collective also recognized as APT-C-00, Canvas Cyclone (formerly Bismuth), Cobalt Kitty, and OceanLotus. The breach is suspected to have persisted for a minimum of four years.
“This breach shares several strategies used by the hacker group APT32/OceanLotus, and targets a known demographic that aligns with the victims of APT32/OceanLotus,” mentioned security analysts Jai Minton and Craig Sweeney stated.
OceanLotus, active since at least 2012, has a background of targeting corporate and government networks in East-Asian nations, particularly in Vietnam, the Philippines, Laos, and Cambodia with the intent of cyber spying and theft of intellectual property.
Attack strategies usually involve targeted phishing baits as the initial method of access to introduce backdoors capable of executing arbitrary shellcode and gathering confidential details. Nevertheless, the group has also been noticed organizing watering hole campaigns as far back as 2018 to compromise site visitors with a reconnaissance payload or harvest their login credentials.
The most recent series of breaches identified by Huntress extended to four systems, each of which was infiltrated to include various scheduled tasks and entries in the Windows Registry responsible for initiating Cobalt Strike Beacons, a backdoor that facilitates the theft of Google Chrome cookies for all user profiles on the machine, and loaders responsible for executing embedded DLL payloads.
This development coincides with a continuing campaign targeting South Korean individuals, employing likely spear-phishing tactics and exploiting vulnerable Microsoft Exchange servers to introduce reverse shells, backdoors, and VNC malware to achieve control over compromised devices and pilfer credentials stored in web browsers.
About Author
