Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
52
Threat actor
OceanLotus
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenAug 17, 2026
- Last mentionedAug 17, 2026
Timeline
1 articles · newest firstAppears with
- APT32threat actor · 1
- KerrDownmalware · 1
- Microsoftvendor · 1
- Palo Alto Networksvendor · 1
- Cobalt Strikeproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.