Rewterz Threat Alert – APT32 Ocean Lotus – Active IOCs

Severity

Medium

Analysis Summary

Cyber espionage actors, aka APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

Impact

• Information Theft
• Security Bypass

Indicators of Compromise

MD5

• e00291eaf259766b04c5c9eaf3f0b2a0

SHA-256

• 7dc3c9d9a9192794a913c9b37e8acafa088b5cd4ea4f6313036832b6aba13b85

SHA-1

• 25a2604d5f685d1bfa67bdfac3d5e7e815a3d13d

Remediation

• Search for IOCs in your environment.
• Block all the threat indicators in their respective controls.