ESET OceanLotus

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

APT32 includes garbage code to mislead anti-malware software and researchers.

APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.

APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.

APT32 has infected victims by tricking them into visiting compromised watering hole websites.

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

APT32 has sent spearphishing emails containing malicious links.