Cyber Incident Victim: Cambodian Ministry of Foreign Affairs and International Cooperation
Date:
Jan 2015
Location:
Cambodia
Summary
A sophisticated cyberespionage campaign attributed to the Vietnam-based OceanLotus group (APT32) targeted the Cambodian Ministry of Foreign Affairs and International Cooperation alongside other ASEAN governments, militaries, media outlets, and civil society organizations. The attackers compromised over 100 websites to deploy strategic JavaScript injections, custom malicious Google Apps for credential theft, and impersonated legitimate services through counterfeit domains. This enabled large-scale digital surveillance, social engineering, and malware distribution—primarily using Cobalt Strike backdoors—via a globally distributed infrastructure leveraging Let’s Encrypt certificates. The operation systematically profiled victims through whitelisted targeting and harvested sensitive communications, contacts, and organizational data.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In May 2017, Volexity identified a widespread digital surveillance and attack campaign targeting multiple Asian nations, including ASEAN member states, along with organizations and individuals associated with government, military, human rights, civil society, and media sectors. The campaign, attributed to the Vietnam-based OceanLotus group (also known as APT32), employed strategically compromised websites to profile visitors and deliver malicious payloads during high-profile ASEAN summits. Attackers modified JavaScript on over 100 compromised websites to selectively target visitors through whitelists, ensuring only specific individuals and organizations received malicious content. The group deployed custom Google Apps designed to steal Gmail credentials and contacts, while mimicking legitimate services like Facebook, Google, and Cloudflare through attacker-controlled domains. OceanLotus utilized Let’s Encrypt SSL/TLS certificates extensively across their infrastructure, which spanned multiple hosting providers and countries to distribute backdoors including Cobalt Strike and other proprietary malware.
The operation facilitated mass information collection through compromised state oil exploration entities, media outlets, and civil society groups. Volexity assessed the campaign’s scale as comparable only to historical operations by the Russian Turla APT group. Impacted systems experienced unauthorized email access, contact theft, and covert surveillance. Defensive measures included blocking domains and IP addresses associated with OceanLotus infrastructure, implementing two-step authentication for Google accounts, and maintaining system updates with strong passwords. The attacks demonstrated advanced tactics through targeted social engineering, infrastructure diversification, and continuous adaptation across multiple ASEAN-related events.