OceanLotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society

Volexity describes a sophisticated, large-scale OceanLotus (APT32) campaign that compromised more than 100 websites—many tied to Vietnamese civil society, media, and regional/state organizations—to deliver malicious JavaScript for profiling, fingerprinting, and selectively targeting visitors. The attackers used webshells for persistence, two custom JavaScript frameworks to collect host/browser data, whitelists to trigger convincing OAuth-based popups that granted access to victims' Google accounts (allowing email/contact exfiltration), and distributed malware/backdoors (including Cobalt Strike); the report provides extensive IoCs (domains, IPs, network signatures) and remediation recommendations.