Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations

FireEye/Mandiant analyzes APT32 (OceanLotus) cyber‑espionage activity targeting private sector firms, governments, and Vietnamese diaspora since at least 2013–2017; the report details multilingual ActiveMime phishing lures, macro and scheduled‑task persistence mechanisms, multi‑stage in‑memory backdoors (including Meterpreter, Cobalt Strike BEACON, and custom backdoors), malware capabilities, extensive C2 infrastructure, and provides IOCs and detection guidance (YARA).