Full Report
Huntress identified an intrusion against a non-profit supporting Vietnamese human rights that’s likely spanned years. Jump in as we provide a thorough analysis of this malicious threat actor.
Analysis Summary
# Threat Actor: APT32 (OceanLotus)
## Attribution & Identity
* **Actor Identification:** APT32 (also known as OceanLotus).
* **Aliases:** OceanLotus, SeaLotus, Bismuth.
* **Known Associations:** Widely believed to be a state-sponsored group acting in the interest of the Vietnamese government.
* **Confidence Level:** High overlap in TTPs and targeting alignment (Vietnamese human rights defenders).
## Activity Summary
Huntress identified a long-term intrusion against a non-profit supporting Vietnamese human rights. The operation is estimated to have spanned at least **four years**, characterized by extreme stealth and low-volume administrative activity designed to evade detection. The actor maintained multiple layers of persistence to ensure continued access even if one mechanism was discovered.
## Tactics, Techniques & Procedures
* **Persistence via Scheduled Tasks:** Creation of tasks disguised as legitimate software updates (e.g., "Adobe Flash Updater"). [T1053.005]
* **Living off the Land (LotL):** Heavy use of `wscript.exe` to execute scripts. [T1059.005]
* **Stealthy Execution:** Commands were run infrequently (max 12 per day, often only 3 per 10-minute window) to avoid triggering threshold-based alerts.
* **Alternative Data Streams (ADS):** Storing malicious code in NTFS file streams to hide scripts from standard file system visibility (e.g., `scheduler.ps1:log.txt`). [T1564.004]
* **Masquerading:** Using legitimate-looking file paths and names within `C:\ProgramData\` and `C:\Windows\System32\`. [T1036]
* **Scripting:** Extensive use of VBScript and PowerShell for automation and persistence.
## Targeting
* **Sectors:** Non-profit organizations, Human Rights Defenders (HRDs), and civil society groups.
* **Geography:** Vietnam (specifically targeting those critical of or operating in opposition to state interests).
* **Victims:** An unnamed non-profit organization supporting Vietnamese human rights.
## Tools & Infrastructure
* **Malware Families:** Custom scripts (VBScript/PowerShell) associated with the OceanLotus toolkit; Adobe-themed loaders.
* **Infrastructure:**
* **Binaries:** `wscript.exe` (System32)
* **Paths:** `C:\ProgramData\AppData\Roaming\Adobe\Updater\scheduler\`
* **Files (Defanged):** `scheduler.ps1:log[.]txt`
## Implications
This intrusion highlights the persistence and patience of state-sponsored actors when targeting high-value intelligence targets like human rights defenders. The use of low-and-slow tactics (minimal command execution over years) demonstrates a sophisticated understanding of EDR limitations. It suggests that for non-profits, the threat is not merely financial but centers on long-term espionage and monitoring of political dissent.
## Mitigations
* **Monitor Scheduled Tasks:** Audit for tasks running from `C:\ProgramData` or using `wscript.exe`/`cscript.exe` with unusual arguments.
* **Inspect ADS:** Regularly scan for files containing Alternative Data Streams, which are frequently used by APT32 to hide payloads.
* **Behavioral Baselining:** Look for "slow" administrative activity. Even if volume is low, unauthorized use of `net`, `whoami`, or `tasklist` from a script-based process should be investigated.
* **Endpoint Hardening:** Restrict script execution policies and consider blocking `wscript.exe` from executing files in user-writable directories like `C:\ProgramData`.