Terracotta VPN - Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 13:54:58 UTC Home > List all groups > List all tools > List all groups using tool Terracotta VPN Tool: Terracotta VPN Names Terracotta VPN Category Malware Type Tunneling Description (RSA) Terracotta VPN is the name used by RSA Research to describe the dynamically-maintained conglomerate of multiple VPN “brand” names marketed on Chinese-language websites. The websites are principally linked by common domain name registrant email addresses and are often hosted on the same infrastructure with the same basic web content. Information Last change to this tool card: 20 April 2020 Download this tool card in JSON format All groups using tool Terracotta VPN Changed Name Country Observed APT groups   APT 32, OceanLotus, SeaLotus 2013-Aug 2024 1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b27a853e-63e0-41ac-87b5-56888613e2e2 https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=b27a853e-63e0-41ac-87b5-56888613e2e2 Page 1 of 1