APT32__2021__amnesty.org-Click_and_Bait_Vietnamese_Human_Rights_Defenders_Targeted_with_Spyware_Attacks.pdf

Amnesty International's Security Lab revealed a targeted spyware campaign attributed to Ocean Lotus (APT32) that used spear-phishing emails delivering macOS and Windows implants — including a Kerrdown downloader that deployed Cobalt Strike and bespoke macOS spyware — to fully monitor Vietnamese human rights defenders and the NGO VOICE from 2018–2020; the report documents infection chains, victimized individuals and organizations, links the targeting to Vietnamese state interests, and issues recommendations for investigation and protection.