OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society | Volexity

Volexity reports that OceanLotus (APT32) conducted a widespread, highly targeted digital-surveillance campaign by compromising over 100 strategic websites across ASEAN and neighboring countries to deliver two JavaScript profiling frameworks that fingerprint visitors, whitelist targets, and present social-engineered popups that trick selected users into granting OAuth access to Google accounts; the group also distributed malware (including Cobalt Strike and custom webshells) and maintained a sprawling malicious infrastructure, with numerous domains, IPs, and network signatures provided alongside defensive recommendations.