Facebook Tracks APT32 OceanLotus Hackers to IT Company in Vietnam

Cybersecurity researchers from Facebook today formally linked
the activities of a Vietnamese threat actor to an IT company in the
country after the group was caught abusing its platform to hack
into people’s accounts and distribute malware.

Tracked as APT32^[1]
(or Bismuth, OceanLotus, and Cobalt Kitty), the state-aligned
operatives affiliated with the Vietnam government have been known
for orchestrating sophisticated espionage campaigns^[2]
at least since 2012 aligned with the goal of furthering the
country’s strategic interests.

“Our investigation linked this activity to CyberOne Group, an IT
company in Vietnam (also known as CyberOne Security, CyberOne
Technologies, Hành Tinh Company Limited, Planet and Diacauso),”
Facebook’s Head of Security Policy, Nathaniel Gleicher, and Cyber
Threat Intelligence Manager, Mike Dvilyanski, said^[3].

Facebook’s unmasking of APT32 comes months after Volexity^[4]
disclosed multiple attack campaigns launched via multiple fake
websites and Facebook pages to profile users, redirect visitors to
phishing pages, and distribute malware payloads for Windows and
macOS.

Additionally, ESET reported a similar operation^[5]
spreading via the social media platform in December 2019, using
posts and direct messages containing links to a malicious archive
hosted on Dropbox.

The group is known for its evolving toolsets and decoys and its
use of decoy documents and watering-hole attacks^[6]
to entice potential victims into executing a fully-featured backdoor^[7]
capable of stealing sensitive information.

OceanLotus gained notoriety early last year^[8]
for its aggressive targeting of multinational automotive companies
in a bid to support the country’s vehicle manufacturing goals.

During the height of the COVID-19 pandemic, APT32 carried out
intrusion campaigns^[9]
against Chinese targets, including the Ministry of Emergency
Management, with an intent to collect intelligence on the COVID-19
crisis.

Last month, Trend Micro^[10] researchers uncovered a
new campaign leveraging a new macOS backdoor that enables the
attackers to snoop on and steals confidential information and
sensitive business documents from infected machines.

Then two weeks ago, Microsoft^[11] detailed a tactic of
OceanLotus that involved using coin miner techniques to stay under
the radar and establish persistence on victim systems, thus making
it harder to distinguish between financially-motivated crime from
intelligence-gathering operations.

Now according to Facebook, APT32 created fictitious personas,
posing as activists and business entities, and used romantic lures
to reach out to their targets, ultimately tricking them into
downloading rogues Android apps through Google Play Store that came
with a wide range of permissions to allow broad surveillance of
peoples’ devices.

“The latest activity we investigated and disrupted has the
hallmarks of a well-resourced and persistent operation focusing on
many targets at once, while obfuscating their origin,” the
researchers said. “To disrupt this operation, we blocked associated
domains from being posted on our platform, removed the group’s
accounts and notified people who we believe were targeted by
APT32.”

In a separate development, Facebook said it also disrupted a
Bangladesh-based group that targeted local activists, journalists,
and religious minorities, to compromise their accounts and amplify
their content.

“Our investigation linked this activity to two non-profit
organizations in Bangladesh: Don’s Team (also known as Defense of
Nation) and the Crime Research and Analysis Foundation (CRAF). They
appeared to be operating across a number of internet services.”