OceanLotus: From external espionage to domestic targeting
OceanLotus, a Vietnamese-aligned cyberespionage group (formerly APT32), has shifted its focus from external espionage to domestic targeting, particularly in relation to corruption investigations in Vietnam. Since 2020, following a public exposure, the group has demonstrated a more selective approach to foreign operations while increasingly targeting domestic entities. Recent activity includes a supply-chain attack targeting a Vietnamese stock investment platform (FireAnt Metakit) to deliver the SPECTRALVIPER backdoor, and a separate intrusion into a Vietnamese infrastructure and transport construction corporation. The group leverages vulnerabilities and supply-chain compromises to deploy its backdoors, and appears to be aligned with Vietnam’s efforts to combat corruption and financial crime.
Our tracking of OceanLotus activities from 2024–2026 reveals a shift in operational focus. During this period, the Vietnam-aligned OceanLotus adopted a more selective approach to external operations while placing increasing emphasis on domestic espionage. We identified two distinct campaigns involving the SPECTRALVIPER backdoor: a supply-chain attack targeting stock investors in Vietnam and a prolonged espionage operation against a Vietnamese infrastructure and transport construction company.
Between 2017 and 2020, OceanLotus attracted significant public attention following multiple reports detailing its cyberespionage activities. These included large-scale watering hole attacks targeting Southeast Asia in 2017–2018, intrusions into corporations such as BMW and Hyundai in 2019, and the targeting of a Vietnamese dissident in Germany that same year. The group was also linked to operations against human rights defenders between 2019 and 2020, as well as espionage targeting the Wuhan municipal government in 2020. However, the group’s operations faced a setback in 2020 when Facebook publicly identified the company believed to be used as a front for OceanLotus. Following this exposure, public reporting on the group diminished significantly, and its activities received comparatively little attention for several years.
OceanLotus resurfaced publicly in 2023 with a report from Elastic Security Labs that described an attack using a previously undocumented backdoor it named SPECTRALVIPER and that targeted Vietnamese businesses. Building on this, our research examines the group’s more recent activity, observed from mid-2024 through early 2026. During this period, we identified two distinct campaigns that both relied on SPECTRALVIPER as their primary backdoor but had very different target victim profiles.
The first campaign involved the compromise of an infrastructure and transport construction corporation. This intrusion began in mid-2024 and persisted until February 2026. Although the initial access vector was not directly observed, our analysis of victim's public-facing servers suggests that the attacker may have exploited remote code execution (RCE) vulnerabilities in a Microsoft SQL server to establish an initial foothold.
The second campaign was a supply-chain attack that began in late 2025 and continued until March 2026. In this operation, OceanLotus compromised the update server of FireAnt Metakit, a Vietnamese stock investment platform, and replaced legitimate software updates with a malicious payload that ultimately deployed SPECTRALVIPER. This campaign appears to have targeted stock investors and may be linked to Vietnam’s recent efforts to promote securities market reforms, suggesting a possible connection to domestic monitoring or investigative objectives.
We estimate that the FireAnt supply-chain attack began around October 2025 and continued until March 2026. During this period, we identified a few stock investors exposed to the supply-chain; however, only a small subset of them ultimately received the SPECTRALVIPER backdoor. Our team made multiple attempts to notify FireAnt of the incident but received no response. FireAnt is a Vietnam‑based fintech company that offers a platform for stock market data, analysis, and investment support tools for both individual and institutional investors. It is considered one of the leading digital investment platforms in Vietnam, providing real‑time market data, technical analysis features, and AI‑driven insights, along with a community component where investors can share information and opinions. Within this ecosystem, FireAnt MetaKit is a specialized software component focused on data delivery. It is designed to provide real‑time and historical financial market data directly to technical analysis platforms such as AmiBroker, MetaStock, and MetaTrader.
On October 2nd, 2025, we detected the first malicious payload originating from FireAnt MetaKit’s legitimate update URL http://metakit.fireant[.]vn/Software/setup.exe. The domain resolved to the genuine IP address of the FireAnt update server, suggesting a supply-chain compromise scenario. Our analysis of this payload reveals a first-iteration downloader, indicating that this activity likely represents the early stage of the campaign, where OceanLotus was testing the delivery mechanism on the initial victims. In Table 1, we compare this initial downloader with the stable version observed later in the campaign.
Second, the lack of SSL/TLS encryption in the network protocol used for obtaining both the version.xml file and any updated binary makes FireAnt MetaKit vulnerable to interception attacks; however, we have not observed OceanLotus leveraging this technique in this campaign.
The execution chain
Due to the absence of signature validation, Metakit.exe executed the malicious downloader as a legitimate update. Once launched, the downloader performed basic host reconnaissance and transmitted the collected information via an HTTP POST request to a staging server, requesting the next-stage payload (Figure 2).
Across all observed samples, the download API V1/Update/GetUpdate remained consistent. However, the staging infrastructure evolved over time, with C&C servers initially hosted at 139.162.11[.]152 and later migrating to 142.91.98[.]77.
In the subsequent stage, the downloader deployed a side-loading chain involving DtlCrashCatch.dll, which is SPECTRALVIPER configured as a loader, and its companion executable, IntelAudioService.exe. The latter was executed with the command: C:\Users\[redacted]\ telAudio\Service\IntelAudioService.exe /appmodel /StateRepository /Service
Analysis revealed that IntelAudioService.exe is in fact a copy of the legitimate, signed executable dtlupdate.exe, as shown in Figure 3.
Once executed, DtlCrashCatch.dll injects itself into the OneDrive.Sync.Service.exe process, enabling execution in backdoor mode. The backdoor then issues a beacon request to the hardcoded URL https://financemachinelearning[.]com/apparatus/wind/twig/statement.html, embedding encrypted host information within the HTTP Cookie header. Historically, this data was prefixed with euconsent-v2=; however, in this campaign, we observed the use of the prefix, zd_cs_pm= (Figure 4), marking the first instance of this variation.
The complete execution chain is summarized in Figure 5.