Ocean Lotus Blossoms: Mass Digital Surveillance and Attacks Targeting ASEAN, Asian Nations, the Media, Human Rights Groups, and Civil Society
Summary: Volexity began tracking a mass digital surveillance and attack campaign in May 2017, tied to the Vietnam-based APT group OceanLotus (APT32), which compromised more than 100 websites - over 80 belonging to Vietnamese individuals and organizations critical of the Vietnamese government, with the rest tied to state-owned or affiliated organizations in countries bordering Vietnam or the Philippines. The compromised sites, including the main ASEAN website, delivered malicious JavaScript that profiled and fingerprinted visitors, and in some cases users were redirected to a Google OAuth prompt granting an OceanLotus app access to all email and contacts.
Why it matters: More than 100 strategically compromised websites, running largely unnoticed since late 2016 and timed around high-profile ASEAN summits, were used to profile visitors and, through a convincing Google OAuth prompt, hand over full email and contacts access - a scale Volexity says was previously rivaled only by the Russian APT Turla.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026