Vietnamese hacking group OceanLotus (APT32): Extending Cyber Espionage Operations

guest · Nov 6, 2020

Vietnamese hacking group OceanLotus uses imitation news sites to spread malware
November 6, 2020
https://www.cyberscoop.com/vietnam-hacking-oceanlotus-apt32-fake-news/

Suspected Vietnamese government-linked hackers are behind a series of fake news websites and Facebook pages meant to target victim with malicious software, according to Volexity research published Friday.

The hackers, known as OceanLotus or APT32, historically have targeted companies that have business interests in Vietnam. In this case, the fake sites and Facebook pages, which were set up within the last year, were intended for targets in Vietnam and across Southeast Asia, according to Volexity researchers.
They also occasionally target victims with malware meant to log targets’ keystrokes.
Click to expand...

In this case, OceanLotus is suspected to send victims links to its sites through spearphishing or social media messaging.
The fake sites themselves, which are still active, are not entirely malicious.

But the campaign adds to a growing body of research that shows the suspected Vietnamese government-linked hackers steadily working on their targeting approach, researchers say.

“OceanLotus has continued to evolve the ways in which it seeks to target individuals outside of spear phishing and leveraging compromised websites,” Volexity researchers write in the blog.
“This level of effort shows that OceanLotus will go to great lengths to extend its reach and find new ways to compromise individuals and organizations it has set its focus on.”
Click to expand...

Volexity: OceanLotus: Extending Cyber Espionage Operations Through Fake Websites

Throughout the year, Volexity identified multiple Vietnamese-language news websites that appeared to be compromised, as they were being used to load an OceanLotus web profiling framework. The exact functionality varied from site to site, but the goal of these frameworks was to gather information about site visitors and, in some cases, deliver malware.

However, upon closer inspection of the websites, Volexity found the sites were not compromised, instead they were created and operated by OceanLotus. Each of the websites appears to have had a decent level of effort to build it, as there are numerous variations in themes, content, and even custom images and slogans.
[/quot€]
Click to expand...

guest · Dec 1, 2020

Vietnam-linked Bismuth APT leverages coin miners to stay under the radar
Microsoft warns of Vietnam-linked Bismuth group that is deploying cryptocurrency miner while continues its cyberespionage campaigns
December 1, 2020
https://securityaffairs.co/wordpress/111716/apt/bismuth-crypto-miners.html

Researchers from Microsoft reported that the Vietnam-linked Bismuth group, aka OceanLotus, Cobalt Kitty, or APT32, is deploying cryptocurrency miners while continues its cyberespionage campaigns.

The use of cryptocurrency miners was first observed by Microsoft this summer when the group deployed them in attacks against organizations in France and Vietnam.

“But in campaigns from July to August 2020, the group deployed Monero coin miners in attacks that targeted both the private sector and government institutions in France and Vietnam.” Microsoft said.
“While this actor’s operational goals remained the same—establish continuous monitoring and espionage, exfiltrating useful information as is it surfaced—their deployment of coin miners in their recent campaigns provided another way for the attackers to monetize compromised networks.”
According to Microsoft, the APT group started using the crypto-mining malware to trick the defense staff of the targets into believing their attacks are not highly targeted intrusions.
Click to expand...

Threat actors heavily use DLL side-loading, a technique in which a legitimate DLL is replaced with a malicious one so that it is loaded when the associated application is executed.

“To perform DLL sideloading, BISMUTH introduced outdated versions of various applications, including Microsoft Defender Antivirus. They also leveraged the Sysinternals DebugView tool, the McAfee on-demand scanner, and Microsoft Word 2007.” continues the report.

To deploy the coin miners, BISMUTH first dropped a .dat file and loaded the file using rundll32.exe, which in turn downloaded a copy of the 7-zip tool named 7za.exe and a ZIP file. Then the hackers used 7-Zip to extract a Monero coin miner from the ZIP file and registered the miner as a service named after a common Virtual Machine process.
Click to expand...

Log in or Sign up

Vietnamese hacking group OceanLotus (APT32): Extending Cyber Espionage Operations

guest Guest

guest Guest

Log in or Sign up

Vietnamese hacking group OceanLotus (APT32): Extending Cyber Espionage Operations

guest Guest

guest Guest

Useful Searches