Learning from the Enemy: A Look Inside the Techniques of Ocean Lotus /APT32
summary
Demonstration shows two real OceanLotus/APT32 fileless attacks: a DDE field and a macro-laden resume that never writes payloads to disk but loads a PowerShell or Python client into memory, connects back to TrevorC2 and accepts posted commands (e.g., launches calc, lists directories, kills winword.exe). Commands are base64-encoded into the document properties (Company/Comments), decoded by embedded VB, and work cross‑platform against Office 2011 Mac (including an iTunes/iCloud password prompt extract). The attacks successfully achieve C2 and remote control.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 4:22Demonstration
- 6:43Macros
- 10:47Error Dialogs
- 16:17Macro Attacks
- 22:13Base64 Encoding
- 27:31Testing
related talks
44mAnatomy and Defense of LOTL Fileless Intrusions
51mOffice in Wonderland
25mCommSec D1 - A Deep Dive Into Malicious Documents
52mStart covering your bases & Stop chasing APT headlines
43mMalicious Payloads vs Deep Visibility: A PowerShell Story
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
43mHunting for Bugs, Catching Dragons