Ocean Lotus The cybersecurity firm FireEye Inc. has been tracking APT32 — which is also known as Ocean Lotus and Ocean Buffalo — since 2012, according to Nick Carr, a director at the firm. In 2017, his team investigated a series of hacks in the U.S., Germany and multiple countries in Asia and found that the group had spent at least three years targeting foreign governments, journalists, dissidents and "foreign corporations with a vested interest in Vietnam's manufacturing, consumer products and hospitality sectors." "APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests," FireEye reported. Ongoing tactics by APT32 appear to include registering domains that resemble car companies — a move which can precede phishing attacks, in which credentials are stolen by hackers in order to access internal networks, said John Hultquist, FireEye's director of intelligence analysis.