Skip to content
Nation-state APTEspionageAdvanced sophistication · State-backed

APT32

APT32 is a Vietnam-attributed nation-state APT group with an espionage motive, tracked by Brandefense. It targets 16 sectors, including Government and Technology, in 23 countries, including the United States and the United Kingdom. It uses 169 MITRE ATT&CK techniques and exploits 22 known CVEs.

Also known as
  • SeaLotus
  • APT-C-00
  • Canvas Cyclone
  • BISMUTH
  • OceanLotus
  • Ocean Buffalo
  • Tin Woodlawn
  • SectorF01
  • Atk17
  • APT-LY-100
  • Pond Loach
  • Lotus Bane
  • G0050
  • Operation “PhantomLance”
  • Operation “Cobalt Kitty”
Origin
Vietnam
Techniques
169
Exploited CVEs
22
First seen
Jan 1, 2014
Last seen
May 6, 2021
Record updated

Who They Target.

Labelsespionage

About APT32.

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia.

Last updated Sep 30, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.