OceanLotus Pivots to Domestic Espionage with SPECTRALVIPER

#1

Actor Background — Vietnam-Nexus APT, Active Since 2012

OceanLotus (APT32) is a cyberespionage group aligned with Vietnamese government interests, active since at least 2012. It has historically focused on China, Southeast Asia, and Vietnamese human-rights activists and dissidents. The group maintains an evolving Windows and Linux backdoor arsenal using custom network protocols: Denis/SOUNDBITE (DNS C2), PHOREAL (ICMP C2), WINDSHIELD, and its newest implant SPECTRALVIPER, first documented in 2023. After Facebook exposed its front company in 2020, the group went quiet before resurfacing with a clear domestic intelligence focus.

#2

Domestic Pivot — Two Campaigns, Two Initial Access Vectors

Tracking from 2024 to 2026 confirms OceanLotus has shifted from foreign espionage toward domestic intelligence and surveillance inside Vietnam. Two campaigns ran in parallel: a supply-chain compromise of the FireAnt Metakit update server (October 2025 – March 2026) targeting stock investors in the financial sector; and exploitation of a remote code execution flaw in a public-facing Microsoft SQL Server (mid-2024), targeting a critical-infrastructure and transport construction corporation with host activity persisting from November 2024 to February 2026.

#3

FireAnt Supply-Chain — Unsigned Update Delivers Malicious setup.exe

In the FireAnt attack, OceanLotus hijacked the platform's own update URL to deliver a malicious setup.exe in place of a legitimate update. Because the FireAnt Metakit update process performed no signature or integrity verification and did not use SSL/TLS, Metakit.exe executed the downloader as if it were trusted. The downloader profiled the host, sent fingerprint data to a staging server via HTTP POST, and retrieved the next-stage payload — reaching only a small, hand-picked subset of investors despite the broad potential impact of a supply-chain attack.

#4

DLL Sideloading — IntelAudioService.exe, DtlCrashCatch.dll, OneDrive Injection

A signed binary renamed IntelAudioService.exe sideloaded a rogue DtlCrashCatch.dll — SPECTRALVIPER acting as a loader — which injected the backdoor into OneDrive.Sync.Service.exe. The corporate intrusion replicated this technique using renamed copies of Toolbox.exe invoked with a -uiDll switch, deploying multiple SPECTRALVIPER variants across the network. Renamed masquerade binaries observed include Genuine.exe, Updater.exe, and AutoCAD242.exe.

#5

SPECTRALVIPER C2, Exfiltration & Operation Wrap-Up

SPECTRALVIPER beacons to a hardcoded C2 over HTTPS using a fixed User-Agent. It functions as both a backdoor and a loader capable of injecting additional binaries or shellcode received from the C2. Data is exfiltrated over the same encrypted channel, with traffic disguised using Cookie headers prefixed with euconsent-v2= or zd_cs_pm= and connections to finance- or business-themed C2 domains. The impact: a ~15-month covert foothold in a critical-infrastructure firm and a surgical supply-chain attack. No further malicious updates appeared after March 9, 2026.

Type	Value
SHA1	511b77459673ec42163f19e300ff1d233b6c39fb 59a8553a4f8130f576ab234e0b220be4d4da0e98 9ca1a5c7f79882db913534c1e62b26bcdcb9f6dd a8e2bbbfcb86500322d2367744fa12755ab0c165 f74f1feb62b662cda489fdb2453727824e55acb9 f8f8209987ca7f139de6a62f9e6ee21bd2ae93a9 19a69f856efa811c376f68e4feb0997b4724f8bd 490194e9bb5128eca8693ad9e610891c2ed185af 51176139b0b2220b802c1578a4994df68df5bcd1 91f042f59be4bdcb6e5ea21b91decd731c175b54 a177ed0bffeb1efe1d9d31d72a82ef2625ae646d b7b2d2db544f9eea74453cdf2b8beea58cf07c48 4ad36ad6c165b5174967020cb1a3358f78d7a283 57352b3ceee32216e5aa20baa848483d7ab5a6fb 9bc06df9f932746a05ee728c8b103bd3ba6bf395 865a1739337d3303b3ab02c5e694c22b79c42b7d b0fea981d02f6f76de81ebaefcb68b7d205d6194 48febb91a10d1462461a012fafc0918bb028e947 150764a71deef498de6f8c95ecccb4455c1b601f
Filenames	setup.exe · system.config.xml · NotificationConfig.json DtlCrashCatch.dll · SetupUi.dll
IPv4	38[.]60[.]245[.]37 · 139[.]99[.]33[.]239 · 139[.]162[.]11[.]152 139[.]180[.]128[.]42 · 142[.]91[.]98[.]77 · 166[.]88[.]77[.]186 194[.]68[.]26[.]241 · 103[.]119[.]47[.]104
Domains	leadingfilipinoteams[.]com · coachcybersecurity[.]com gatewayrvcenter[.]com · mxprodesign[.]com financemachinelearning[.]com · power-sync-services[.]com
URLs	hxxp[:]//metakit[.]fireant[.]vn/Software/setup[.]exe hxxp[:]//metakit[.]fireant[.]vn/Software/version[.]xml

Tactic	Technique	Sub-technique & Notes
Initial Access	`T1195`	`T1195.002` Compromise Software Supply Chain — FireAnt Metakit update server hijacked to deliver malicious `setup.exe` without signature or TLS verification
Initial Access	`T1190`	Exploit Public-Facing Application — RCE in a public-facing Microsoft SQL Server used to compromise a critical-infrastructure corporation
Execution	`T1059`	Command and Scripting Interpreter — scripting used post-compromise for staging, profiling, and lateral deployment
Execution	`T1204`	User Execution — victims run the malicious `setup.exe` delivered via the trusted FireAnt Metakit update channel
Persistence	`T1574`	`T1574.001` DLL Sideloading — signed `IntelAudioService.exe` sideloads rogue `DtlCrashCatch.dll`; renamed `Toolbox.exe` copies use `-uiDll` to deploy SPECTRALVIPER variants
Defense Evasion	`T1055`	Process Injection — SPECTRALVIPER injected into `OneDrive.Sync.Service.exe` to blend with legitimate processes
Defense Evasion	`T1036`	Masquerading — binaries renamed as `IntelAudioService.exe`, `Genuine.exe`, `Updater.exe`, `AutoCAD242.exe` to blend with legitimate software
Defense Evasion	`T1027`	Obfuscated Files or Information — SPECTRALVIPER payload obfuscated; C2 traffic encrypted and disguised in Cookie headers
Defense Evasion	`T1553`	`T1553.002` Code Signing — signed legitimate binaries used as sideloading hosts to inherit trust
Discovery	`T1082`	System Information Discovery — downloader profiles host and sends fingerprint data to staging server via HTTP POST before next-stage delivery
Lateral Movement	`T1570`	Lateral Tool Transfer — SPECTRALVIPER orchestrator model relays commands and payloads to other infected hosts via named pipes
Lateral Movement	`T1021`	Remote Services — remote access used to propagate SPECTRALVIPER variants across the compromised corporate network
C2	`T1071`	`T1071.001` Web Protocols — SPECTRALVIPER beacons over HTTPS to hardcoded C2 with a fixed User-Agent; traffic disguised in `euconsent-v2=` / `zd_cs_pm=` Cookie headers
C2	`T1573`	Encrypted Channel — all C2 communications and exfiltrated data sent over HTTPS encryption
C2	`T1105`	Ingress Tool Transfer — SPECTRALVIPER loader pulls additional binaries or shellcode from C2 as directed by the operator
Exfiltration	`T1041`	Exfiltration Over C2 Channel — collected data exfiltrated via the same encrypted HTTPS C2 connection used for beaconing

OceanLotus Pivots to Domestic Espionage with SPECTRALVIPER

OceanLotus Pivots to Domestic Espionage with SPECTRALVIPER

Summary

Actor Group

Actor Details

Recommendations

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

References