APT32
aka OceanLotus, SeaLotus, Canvas Cyclone, BISMUTH, APT-C-00
A spy group suspected to be based in Vietnam that targets Southeast Asian governments, companies and activists. Recently it has hit domestic firms and investors by hijacking software updates.
- Alert level
- 1/ 5
- Reports & advisories (90 days)
- 0
- Known exploited CVEs
- 0
- Personal data leaked (disclosed)
- None confirmed
Attribution
- Suspected Vietnam-based threat group — MITRE ATT&CK
- Assessed as Vietnam-aligned OceanLotus — ESET
How they attack
Entry
Hijacking software updates
Like swapping the contents of a parcel while your usual courier is on the way.
Entry
Targeted phishing emails
Like a letter that seems to come from a colleague, with an envelope that springs a trap when opened.
Goal
Long-term spying
Like leaving a tiny bug in the meeting room and listening in for months.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily