APT32__2021__Amnesty-Bericht-Vietnam-Click-And-Bait-Blogger-Deutschland-Spionage-Menschenrechtsverteidiger-Februar-2021.pdf

Amnesty International's Security Lab documents a coordinated spyware campaign by the group Ocean Lotus (APT32) targeting Vietnamese human rights defenders and a diaspora NGO from 2018–2020; the report details phishing email lures, Mac and Windows malware variants (including a Kerrdown downloader that fetches Cobalt Strike), infection chains, identified email IOCs and recommends independent investigations and protections for targets.