OceanLotus

Malware type
backdoor
Family
Malware family
Last IoC activity
2026-07-22 00:32:35
Profile updated
2026-07-07 12:50:21

Targeted industries: education-and-nonprofits media-and-entertainment transportation-and-logistics

Targeted regions: country_code:vn country_code:cn country_code:ph country_code:th

Context

According to PcRisk, Research shows that the OceanLotus 'backdoor' targets MacOS computers. Cyber criminals behind this backdoor have already used this malware to attack human rights and media organizations, some research institutes, and maritime construction companies. The OceanLotus backdoor is distributed via a fake Adobe Flash Player installer and a malicious Word document (it is likely that threat authors distribute the document via malspam emails).

Reports & references

  • Mandiant — Cyber Espionage Apt32 (report)
  • Trend Micro — New Macos Backdoor Connected To Oceanlotus Surfaces (report)
  • about.fb.com — Taking Action Against Hackers In Bangladesh And Vietnam (report)
  • github.com — Microsoft 365 Defender Hunting Queries (report)
  • malpedia.caad.fkie.fraunhofer.de — Osx.Oceanlotus (report)
  • alienvault.com — Oceanlotus For Os X An Application Bundle Pretending To Be An Adobe Flash Update (report)
  • tradahacking.vn — %C4%91%E1%Bb%A3T R%E1%Bb%93I T%C3%B4I C%C3%B3 %C4%91%C4%83Ng M%E1%Bb%99T Status Xin D%E1%Ba%A1O Tr%C3%Aan Fb May Qu%C3%A1 C%C5%A9Ng C%C3%B3 V%C3%A0I B%E1%Ba%A1N Nhi%E1%Bb%87T T%C3%Acnh G%E1%Bb%Adi Cho 537B19Ee3468 (report)
  • cocomelonc.github.io — Malware Tricks 45 (report)
  • github.com — 2021 02 24 Vietnam (report)
  • cocomelonc.github.io — Malware Tricks 44 (report)
  • bluecyber.hashnode.dev — Apt32 Malware An In Depth Analysis (report)
  • brandefense.io — Ocean Lotus Apt Group (report)
  • researchcenter.paloaltonetworks.com — Unit42 New Improved Macos Backdoor Oceanlotus (report)
  • labs.sentinelone.com — Apt32 Multi Stage Macos Trojan Innovates On Crimeware Scripting Technique (report)
  • Trend Micro — New Macos Backdoor Linked To Oceanlotus Found (report)
  • ESET — Oceanlotus Macos Malware Update (report)

External references