Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations « Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations | FireEye Inc

FireEye details APT32 (OceanLotus) cyber-espionage operations targeting corporations, governments, journalists, and dissidents since at least 2013–2017, describing spear-phishing ActiveMime lures that deploy multi-stage backdoors (custom and commercial like Cobalt Strike), persistence via scheduled tasks, sophisticated obfuscation, and extensive C2 infrastructure; the report includes malware capability summaries, sample IOCs (hashes, domains, IPs), a YARA rule for detection, and assessment of nation-aligned motivations and operational risk.