APT 32, also known as OceanLotus is a Vietnamese state sponsored backed group and has emerged with a new malware targeting MacOS users with the motivation for espionage to aid Vietnamese-owned companies. The MacOS backdoor provides the attackers with a window into the compromised machine, enabling them to snoop on and steal confidential information and sensitive business documents
The attacks begin with phishing emails that attempt to encourage victims to run a Zip file disguised as a Word document. It evades detection from antivirus scanners by using special characters deep inside a series of Zip folders. The attack could potentially give itself away if users are paying attention because, when the malicious file is run, a Microsoft Word document doesn’t appear. At this stage an initial payload is already working on the machine and it changes access permissions in order to load a second-stage payload that then prompts the installation of a third-stage payload, which downloads the backdoor onto the system. By installing the malware across different stages like this, OceanLotus aims to evade detection.