VietnamAssessedVietnam-basedEspionageActive 2014 – 2026

OceanLotus

Also known asSeaLotus · Canvas Cyclone · BISMUTH · Cobalt Kitty · OceanLotus Group · POND LOACH · TIN WOODLAWN · ATK17 · APT-C-00 · APT-LY-100 · SectorF01 · OCEAN BUFFALO

11ATT&CK techniques 4Malware & tools 2Exploited CVEs 2Campaigns 5Sectors

Open the interactive dossier Diamond Model Hunt coverage Tradecraft lanes

Summary

Suspected Vietnam-based espionage group (MITRE G0050; Microsoft Canvas Cyclone) active since at least 2014 against ASEAN governments, foreign companies operating in Vietnam, journalists and dissidents; it stole automotive IP from BMW and Hyundai in 2019 and uses cloud services and social media for C2. ESET's June 2026 report shows a pivot to domestic targeting: a long-running intrusion into a Vietnamese infrastructure and transport construction corporation (2024 → Feb 2026) and a supply-chain compromise of the FireAnt MetaKit update server pushing SPECTRALVIPER to selected retail stock investors (Oct 2025 → Mar 2026). Meta linked the group's activity to the Vietnamese IT company CyberOne Group in Dec 2020; CyberOne denied it.

Attribution

AssessedResearch assessment: Vietnam-based

No government attribution

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

Sources

MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Suspected Vietnam-based
Meta (Research, 2020-12-11)
Linked the activity to CyberOne Group, a Vietnamese IT company

Campaigns 2

Campaign	Period	Targets	Sectors	Source
FireAnt Metakit supply-chain attack	2025-10 – 2026-03	Vietnam	Financial Services, Technology	ESET Research (2026-06-11) — compromised MetaKit update server pushed malicious update delivering SPECTRALVIPER to a few selected stock investors
Vietnamese infrastructure & transport construction corporation — SPECTRALVIPER	2024 – 2026-02	Vietnam	Construction, Transportation	ESET Research (2026-06-11) — long-running intrusion with SPECTRALVIPER (HTTPS C2, injection, named-pipe lateral movement)

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 11

Initial Access2	`T1566.001`Spearphishing Attachment `T1195.002`Compromise Software Supply Chain
Execution1	`T1059.001`PowerShell
Persistence1	`T1137`Office Application Startup
Stealth4	`T1036`Masquerading `T1216.001`PubPrn `T1564.004`NTFS File Attributes `T1027.011`Fileless Storage
Defense Impairment1	`T1222.002`Linux and Mac Permissions
Lateral Movement1	`T1550.003`Pass the Ticket
Command and Control1	`T1102`Web Service

Malware and tools 4

Name	Description	Platform
KerrDown	Downloader	Windows
Cobalt Strike	Post-exploitation	Windows/Linux
METALJACK	Backdoor	macOS
SPECTRALVIPER	Backdoor	Windows

Exploited vulnerabilities 2

CVE	CVSS	Detail
CVE-2016-7255	7.8	Windows Win32k — privilege escalation (KEV 2021-11-03)
CVE-2017-11882	7.8	Office Equation Editor (KEV 2021-11-03)

Highest CVSS first.

Infrastructure patterns

Compromised update server of FireAnt Metakit replaced updates with SPECTRALVIPER (ESET, 2026)
Dropbox, Amazon S3 and Google Drive host payloads; email used for C2 via macro (MITRE ATT&CK, 2026)

Reporting and advisories 3

Mandiant
APT32 and the Threat to Global Corporations
ESET Research
Vietnamese infrastructure & transport construction corporation — SPECTRALVIPER
MITRE ATT&CK
OceanLotus (G0050) group profile