Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations[html]
Cyber espionage actors, now designated by FireEye as APT32
(OceanLotus Group), are carrying out intrusions into private sector
companies across multiple industries and have also targeted foreign
governments, dissidents, and journalists. FireEye assesses that APT32
leverages a unique suite of fully-featured malware, in conjunction
with commercially-available tools, to conduct targeted operations that
are aligned with Vietnamese state interests.
APT32 and FireEye’s Community Response
In the course of investigations into intrusions at several
corporations with business interests in Vietnam, FireEye’s Mandiant
incident response consultants uncovered activity and
attacker-controlled infrastructure indicative of a significant
intrusion campaign. In March 2017, in response to active targeting of
FireEye clients, the team launched a href="https://www2.fireeye.com/WEB-Community-Protection-Security-Numbers.html">Community
Protection Event (CPE) – a coordinated effort between Mandiant
incident responders, FireEye as a Service (FaaS), FireEye iSight
Intelligence, and FireEye product engineering – to protect all clients
from APT32 activity.
In the following weeks, FireEye released threat intelligence
products and updated malware profiles to customers while developing
new detection techniques for APT32’s tools and phishing lures. This
focused intelligence and detection effort led to new external victim
identifications as well as providing sufficient technical evidence to
link twelve prior intrusions, consolidating four previously unrelated
clusters of threat actor activity into FireEye’s newest named advanced
persistent threat group: APT32.
APT32 Targeting of Private Sector Company Operations in Southeast Asia
Since at least 2014, FireEye has observed APT32 targeting foreign
corporations with a vested interest in Vietnam’s manufacturing,
consumer products, and hospitality sectors. Furthermore, there are
indications that APT32 actors are targeting peripheral network
security and technology infrastructure corporations.
Here is an overview of intrusions investigated by FireEye that are
attributed to APT32:
- In 2014, a European corporation was compromised prior to
constructing a manufacturing facility in Vietnam. - In 2016,
Vietnamese and foreign-owned corporations working in network
security, technology infrastructure, banking, and media industries
were targeted.
