OceanLotus Adversary Emulation Plan

October 9, 2023

Project Summary

OceanLotus (aka APT32, SeaLotus, APT-C-00) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists. This project adds the first macOS and Linux focused plans to the Adversary Emulation library for red and blue teams to systematically test their defenses against real-world adversary TTPs.

Problem

Threat intel reporting shows that adversaries are increasingly targeting macOS and Linux systems, and there are no public adversary emulation plans for macOS and Linux with an explanation of defenses from the perspective of the adversary.

Solution

We have created an emulation plan for OceanLotus that starts on macOS and ends on a Linux host with explicit defensive telemetry for a full scope purple teaming perspective.

Impact

This is the first emulation plan released publicly that enables a purple team operation on macOS and Linux, providing visibility into environments inaccessible with current prior resources.