Facebook formally exposed APT32 “OceanLotus” to an IT company in Vietnam, after the group was caught abusing its platform to hack into people's accounts and distribute malware. The IT company is believed to be linked to the Vietnamese government.

APT32 (Ocean Lotus, Cobalt Kitty and Ocean Buffalo)

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

Facebook investigation linked the cyber espionage activity to CyberOne Group, an IT company in Vietnam, which then denied being connected to the hackers.

Facebook said the hackers had used its platforms to carry out a range of cyberattacks, some of which employed fake accounts to trick targets by posing as activists, businesses and possible love interests.

 The group targeted entities such as:

• Vietnamese human rights activists locally and abroad.
• Foreign governments, including those in Laos and Cambodia.
• Non-governmental organizations (NGO).
• News Agencies.
• Businesses across information technology, hospitality, agriculture and commodities, hospitals, retail, the auto industry, and mobile services.

Facebook shared their findings including YARA rules and malware signatures. To disrupt this operation they’ve also blocked associated domains from being posted on their platform, removed the group’s accounts and notified people who we believe were targeted by APT32.