The OceanLotus Group aka APT32 is using a suite of remote access trojans dubbed “Ratsnif” to leverage new network attack capabilities. Researchers have analyzed the Ratsnif trojans, which offer a veritable swiss-army knife of network attack techniques. The trojans, under active development since 2016, combine capabilities like packet sniffing, gateway/device ARP poisoning, DNS poisoning, HTTP injection, and MAC spoofing.
Indicators of Compromise
Malware Hash (MD5/SHA1/SH256)
Block all threat indicators at your respective controls.