Here is the english version of our investigation on #APT32/ #OceanLotus, a group that is relentlessly targeting civil society. We're telling the stories of the people affected, of threat intel analysts tracking them and one (potential) mistake they've made https://web.br.de/interaktiv/ocean-lotus/en/

Thanks to the folks at
@DomainTools, @RiskIQ and @FarsightSecInc for letting us query their databases and walking me through some of the findings. Has been a huge help.

Thanks @MaltegoHQ for showing me how to user their tool for mapping out research like this (next time!).

Forgot to do this, so adding it here, too.

Short walk-through on the technical findings – PassiveDNS & SSL-certificates – right in this thread https://twitter.com/hatr/status/1314170230009212929