Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0050
MITRE ATT&CK Group

APT32 (G0050)

SeaLotusOceanLotusAPT-C-00Canvas CycloneBISMUTH
ShareXLinkedInRedditHN

[APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)

▪Techniques used (78)

T1550.002Pass the HashT1036MasqueradingT1059.007JavaScript

▪Software used (15)

S0002MimikatztoolS0100ipconfigtool
G0050 on MITRE ATT&CK →
T1047Windows Management Instrumentation
T1072Software Deployment Tools
T1570Lateral Tool Transfer
T1564.004NTFS File Attributes
T1552.002Credentials in Registry
T1055Process Injection
T1216.001PubPrn
T1566.001Spearphishing Attachment
T1135Network Share Discovery
T1033System Owner/User Discovery
T1571Non-Standard Port
T1082System Information Discovery
T1583.001Domains
T1012Query Registry
T1027.010Command Obfuscation
T1059.003Windows Command Shell
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1574.001DLL
T1566.002Spearphishing Link
T1598.003Spearphishing Link
T1087.001Local Account
T1059.001PowerShell
T1003.001LSASS Memory
T1046Network Service Discovery
T1608.004Drive-by Target
T1041Exfiltration Over C2 Channel
T1036.004Masquerade Task or Service
T1003OS Credential Dumping
T1078.003Local Accounts
T1589Gather Victim Identity Information
T1070.006Timestomp
T1189Drive-by Compromise
T1218.011Rundll32
T1059Command and Scripting Interpreter
T1112Modify Registry
T1071.003Mail Protocols
T1560Archive Collected Data
T1204.001Malicious Link
T1071.001Web Protocols
T1036.005Match Legitimate Resource Name or Location
T1070.004File Deletion
T1027.011Fileless Storage
T1105Ingress Tool Transfer
T1053.005Scheduled Task
T1036.003Rename Legitimate Utilities
T1543.003Windows Service
T1608.001Upload Malware
T1222.002Linux and Mac Permissions
T1569.002Service Execution
T1018Remote System Discovery
T1218.005Mshta
T1083File and Directory Discovery
T1685.005Clear Windows Event Logs
T1059.005Visual Basic
T1588.002Tool
T1021.002SMB/Windows Admin Shares
T1550.003Pass the Ticket
T1583.006Web Services
T1505.003Web Shell
T1564.001Hidden Files and Directories
T1016System Network Configuration Discovery
T1027.016Junk Code Insertion
T1049System Network Connections Discovery
T1564.003Hidden Window
T1027.013Encrypted/Encoded File
T1056.001Keylogging
T1589.002Email Addresses
T1218.010Regsvr32
T1068Exploitation for Privilege Escalation
T1585.001Social Media Accounts
T1137Office Application Startup
T1203Exploitation for Client Execution
T1204.002Malicious File
T1547.001Registry Run Keys / Startup Folder
T1102Web Service
S0585Kerrdownmalware
S0154Cobalt Strikemalware
S0157SOUNDBITEmalware
S0352OSX_OCEANLOTUS.Dmalware
S0156KOMPROGOmalware
S0108netshtool
S1078RotaJakiromalware
S0158PHOREALmalware
S0099Arptool
S0155WINDSHIELDmalware
S0354Denismalware
S0039Nettool
S0477Goopymalware

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.