The threat landscape surrounding OceanLotus (also known to the cybersecurity community as APT32) has undergone a profound strategic shift. Long recognized as a formidable Advanced Persistent Threat (APT)—a stealthy, state-aligned cyberespionage collective—historically focused on foreign adversaries, recent threat intelligence from 2024 through early 2026 reveals a distinct pivot. The group has realigned its specialized tools toward hyper-selective, high-impact domestic espionage within Vietnam. This development coincides tightly with the Vietnamese government’s intense “Blazing Furnace” anti-corruption campaign, suggesting that state-sponsored apparatuses are increasingly being operationalized for internal financial and political monitoring. By examining two massive concurrent operations, security researchers have peeled back the layers on the group’s primary current payload, the SPECTRALVIPER backdoor, revealing how modern espionage leverages local supply chains and vulnerable enterprise software to gain comprehensive visibility.

Criteria	First iteration	Stable version
First seen	2025‑10‑02	2025‑10‑17
Code obfuscation	None	Heavily obfuscated
Next-stage download	Hardcoded URLs	API request
Payload	An old SPECTRALVIPER sample that appeared in a previous campaign.	Fresh SPECTRALVIPER samples.
Infrastructure	Reused from the previous campaign.	New infrastructure. SPECTRALVIPER C&C domain financemachinelearning[.]com was crafted to target stock investors.

The FireAnt MetaKit Supply-Chain Breach: Weaponizing Financial Data Ecosystems

Between October 2025 and March 2026, OceanLotus executed a highly sophisticated supply-chain intrusion targeting FireAnt MetaKit, a widely used financial data delivery component in Vietnam that feeds real-time market metrics to technical analysis applications like AmiBroker and MetaTrader. The threat actors successfully compromised the vendor’s primary distribution infrastructure, modifying the legitimate update binary (setup.exe) hosted at the official update domain. Security analysts caught the campaign early during a test iteration on October 2, 2025, which used unobfuscated code and hardcoded infrastructure, before the threat actor transitioned to a heavily obfuscated stable release on October 17, 2025. This stable variant replaced direct URLs with dynamic API requests targeting the endpoint V1/Update/GetUpdate.

The underlying vulnerability that facilitated this breach was an architectural oversight in the platform’s update mechanism. The update configuration file, version.xml, completely lacked any cryptographic signature verification or integrity validation controls. Furthermore, the protocol relied entirely on cleartext HTTP transport rather than encrypted SSL/TLS (Secure Sockets Layer/Transport Layer Security), leaving the update mechanism inherently exposed to manipulation. Because the parent process executed the incoming update binary without checking its digital signature, the malicious downloader ran with the permissions of the genuine application, effortlessly bypassing local application control policies.

Inside the Execution Chain: DLL Side-Loading and Evasion Mechanics

Once the initial downloader achieved execution on a target workstation, it initiated an intricate multi-stage execution pipeline engineered to bypass modern Endpoint Detection and Response (EDR) platforms. The downloader carried out a native host reconnaissance routine, harvesting system architecture details, user privileges, and network configuration data, which it packed into an HTTP POST request and sent to staging Command and Control (C2) servers. Upon receiving the appropriate response, the loader deployed a classic DLL side-loading chain—a technique where a threat actor drops a malicious Dynamic Link Library (DLL) into a folder alongside a legitimate, trusted application so that the application inadvertently loads the malware.

In this specific campaign, OceanLotus dropped a legitimate, digitally signed utility called dtlupdate.exe but renamed it to IntelAudioService.exe to blend into typical Windows environments. When executed, this signed binary automatically looked for and loaded its companion library, DtlCrashCatch.dll, which was actually the SPECTRALVIPER implant configured in loader mode. To minimize its disk footprint and maintain an evasive profile, the loader injected its core payload directly into the memory space of the active OneDrive.Sync.Service.exe process. Operating completely from memory, the backdoor established an encrypted beaconing channel to the C2 domain financemachinelearning[.]com. Notably, the group modified its signature network footprint, switching its encrypted host profiling string from the historical euconsent-v2= prefix to a newly observed zd_cs_pm= parameter hidden inside the standard HTTP Cookie header.

Enterprise Penetration: Targeted Intrusion of the Infrastructure Sector

Parallel to the financial supply-chain attack, OceanLotus maintained a highly persistent, separate operation from November 2024 through February 2026 targeting a massive Vietnamese infrastructure and transport construction corporation. While the entry vector differed from the supply-chain compromise, the end goal remained identical: the long-term deployment of SPECTRALVIPER. Forensics suggest the initial entry was achieved by scanning for and exploiting unpatched Remote Code Execution (RCE) vulnerabilities—flaws allowing an attacker to run arbitrary commands over a network—on public-facing Microsoft SQL (MS SQL) database servers.

Once network access was secured, the threat actor did not broadcast its presence; instead, it moved laterally across the internal network with high precision. Investigators discovered three distinct variants of the SPECTRALVIPER backdoor deployed simultaneously on different servers within the same corporate environment. In this environment, the malware communicated with a separate infrastructure hub at gatewayrvcenter[.]com. Operating as a robust orchestration utility, the backdoor allowed operators to push down custom shellcode, manipulate local files, and map out active directory environments, keeping tabs on major logistics and transportation frameworks for over a year.

The Architectural Reveal: Operational Security (OPSEC) Failures

Despite the meticulous design of their payloads, OceanLotus’s campaign ultimately suffered from crucial Operational Security (OPSEC) missteps. During the tracking of their server migrations—specifically when staging infrastructures moved from 139.162.11[.]152 to 142.91.98[.]77—the threat actors left misconfigured directories and debugging artifacts exposed on their internet-facing infrastructure. These oversights provided threat intelligence analysts with an unprecedented internal look at the SPECTRALVIPER architecture.

Rather than looking at a compiled binary on a victim’s machine, researchers were able to view how the backdoor structures its command modules, handles automated data exfiltration, and maintains its internal configuration blocks. The exposed data confirmed that SPECTRALVIPER is highly modular, containing dedicated plugins for specific tasks such as credential harvesting, process termination, and secure proxy traversal. This glimpse into the threat actor’s factory floor stripped away much of the backdoor’s defense-in-depth advantage, allowing security vendors to generate highly accurate Yara rules and behavioral signatures to shut down the infrastructure globally.

Editorial Analysis: Our Opinion on the OceanLotus Domestic Shift

The pivot of OceanLotus from broad international espionage to highly selective domestic surveillance represents a critical inflection point in the behavior of state-aligned Advanced Persistent Threats. Traditionally, national cyber arsenals are reserved for external power projection—targeting foreign governments, global defense contractors, and geopolitical rivals. Redirecting these advanced capabilities inward to monitor local stock investors, fintech platforms, and transport corporations signals a profound change in how state resources are leveraged during internal political realignments.

This tactical transition perfectly mirrors Vietnam’s intensive “Blazing Furnace” anti-corruption campaign. In an era where corporate fraud, misreported bond sales, and institutional bribery can disrupt market stabilities and threaten state legitimacy, cyberespionage tools are no longer just military assets; they are economic regulatory instruments. By weaponizing a widely used financial analysis tool like FireAnt MetaKit, OceanLotus demonstrated that no domestic supply chain is sacred when high-level investigative visibility is required.

Ultimately, this case serves as a harsh warning to organizations operating within the home regions of aggressive APT groups. Domestic enterprises can no longer assume they are safe from state-grade attacks simply because they are local. When internal political priorities shift, the very capabilities developed to combat foreign adversaries can instantly be turned inward, turning routine local corporate software into ground zero for national security monitoring.