Cataloged
IdentityAlias: SeaLotus
Reviewed identity mapping approved on this date.
APT32
Also known as SeaLotus, OceanLotus, APT-C-00, Canvas Cyclone, BISMUTH
Tracked as
G0050
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: OceanLotus
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: APT-C-00
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Canvas Cyclone
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: BISMUTH
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G0050
Reviewed identity mapping approved on this date.
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
APT32Canonical Name
APT-C-00Alias
BISMUTHAlias
Canvas CycloneAlias
OceanLotusAlias
SeaLotusAlias
G0050Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...