Oceanlotus
Overview
Executive Summary
OceanLotus (also widely known as APT32 or Canvas Assassin) is a highly sophisticated Advanced Persistent Threat (APT) group believed to be aligned with the state interests of Vietnam. Active since at least 2013, OceanLotus conducts targeted cyber espionage campaigns against foreign corporations (particularly in the manufacturing, consumer products, and hospitality sectors), foreign governments, dissidents, and journalists.Infection Vector and Technical Capabilities
OceanLotus relies heavily on highly targeted, culturally specific spear-phishing campaigns containing weaponized attachments (often utilizing CVE-2017-11882) or strategic web compromises (Watering Hole attacks) to gain initial access. Their toolset is highly customized and evinces a deep understanding of multiple operating systems:- Cross-Platform Capabilities: OceanLotus is unique in its deployment of sophisticated backdoors tailored for both Windows and macOS environments. Their macOS malware is often disguised as legitimate software installers or documents.
- Custom Backdoors (Cobalt Strike & Custom Implants): The group frequently utilizes heavily obfuscated variants of Cobalt Strike alongside custom-built, multi-stage backdoors (like Windshield or Denis) designed for long-term espionage, file exfiltration, and lateral movement.
- Evasion and Obfuscation: The group employs advanced evasion techniques, including deep shellcode obfuscation, in-memory execution, Steganography (hiding payloads in image files), and utilizing legitimate cloud services (like Google Drive) for C2 communication to bypass network perimeter defenses.
Threat Assessment
Detection of OceanLotus (APT32) activity is a critical, "glass break" security incident. It indicates that the organization is actively being targeted by a well-resourced, highly skilled nation-state actor focused on long-term intellectual property theft and surveillance.Incident Response and Remediation
- Assume Broad Compromise: Due to the advanced nature of the threat actor, incident responders must assume that initial access on a single endpoint has already resulted in lateral movement and credential theft across the Active Directory environment.
- Hunt for Anomalies (EDR): Traditional AV is insufficient. Responders must utilize EDR telemetry to hunt for specific OceanLotus behaviors: anomalous PowerShell execution, `mshta.exe` abuse, unauthorized scheduled tasks, and C2 beacons to cloud infrastructure.
- Coordinated Eviction: Eradication requires a highly coordinated, enterprise-wide effort to simultaneously sever C2 channels, reset all domain credentials, and rebuild compromised infrastructure to prevent the actor from re-establishing persistence.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1566.001 T1059.001 T1132.001 T1105
Tactical Mitigations
Based on the techniques used by this family, consider the following defensive strategies:
- T1059.001: Restrict execution of PowerShell. Enforce PowerShell Constrained Language Mode and Script Block Logging.
- T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.
- T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_OCEANLOTUS {
meta:
description = "Detects Oceanlotus (backdoor)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "oceanlotus" ascii wide nocase
$s2 = "apt32" ascii wide nocase
$s3 = "canvas assassin" ascii wide nocase
$s4 = "sealotus" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Oceanlotus Activity
id: 3dbeea72b643a12f46ba590532f0d488
status: experimental
description: Detects generic indicators of the oceanlotus malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*oceanlotus*"
- "*apt32*"
- "*canvas assassin*"
- "*sealotus*"
condition: selection
level: mediumReferences & External Analysis
- Search "oceanlotus" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Oceanlotus Backdoor from Windows?
Manual removal of Oceanlotus is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Oceanlotus a virus or a Backdoor?
Oceanlotus is classified as a Backdoor. Unlike traditional viruses that infect files, modern malware like Oceanlotus typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Oceanlotus infection?
Symptoms of Oceanlotus can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: backdoor)
Explore other malware families in the same category:
Protect Your Network Against Backdoors
Want to prevent Oceanlotus and similar threats from compromising your organization? Read our comprehensive defensive guide: Backdoor & RAT Protection.
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/oceanlotus.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.