Cybereason Oceanlotus May 2017

APT32 used GetPassword_x64 to harvest credentials.

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

APT32 has used scheduled tasks to persist on victim systems.

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

APT32 has used macros, COM scriptlets, and VBS scripts.

Denis has a command to delete files from the victim’s machine.

APT32 has used email for C2 via an Office macro.

Denis has used DNS tunneling for C2 communications.

Denis has several commands to search directories for files.

APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.

APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

APT32 has used mshta.exe for code execution.

APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.

APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.

APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

APT32 has sent spearphishing emails containing malicious links.

Denis exploits a security vulnerability to load a fake DLL and execute its code.

APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).

APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.