OceanLotus drives your offensive: SPETTRALVIPER, DLL ide-loading and supply chain attacks

Recent findings about the activity of the group known as OceanLotus (also identified as APT32) confirm what the cybersecurity community had been observing: a mature threat that disrupts traditional digital espionage tactics with more selective attacks on the supply chain. According to the analysis shared by the firm ESET, in the last 18 months the actor broke into Vietnamese domestic targets, combining prolonged intrusions into infrastructure companies with an operation to provide committed updates to stock investors through the FireAnt Metakit platform.

The central part of these campaigns was a backdoor called SPECTRALVIPER, which was deployed through a DLL side-rolling: a legitimate executable loads a malicious DLL that ends up injecting code into confidence processes (in this case, OneDrive.Sync.Service.exe) to advance the intrusion and contact command and control servers. In the attack on Metakit the infection chain took advantage of the absence of integrity validation mechanisms in the update file ("version.xml"), which allowed the legitimate installer to execute a malicious discharge without signature checks.

The actor also demonstrated sophisticated victim selection criteria: the payload distribution by the FireAnt update server was limited to a subset of users, suggesting a strategy of targeted and low profile attacks rather than a far-reaching campaign. In parallel, the intrusion into the infrastructure company allegedly took advantage of vulnerabilities on an exposed MS SQL server, maintaining persistent access for months and deploying SPECTRALVIPER variants on multiple machines to move laterally over the network.

This behavior fits the historical trajectory of OceanLotus: an active actor since at least 2012, linked to political and economic espionage operations, who has used water holes, tools like SOUNDBITE or PHOREAL and has returned with new malware families after periods of low visibility. The increased attention to local victims marks a possible shift towards internal objectives but it is not clear whether this is a permanent change or a contextual tactic.

The implications for companies and citizens are clear: the software update chains and public domain applications used by financial professionals have become first-class vectors. When the updating processes do not verify signatures or integrity, a single alteration in the distribution channel compromises all customers who blindly trust that mechanism. In addition, DLL side-rolling technique makes it difficult to detect because it invokes legitimate binary to launch malicious components.

For private organizations and software providers, the first recommendation is to implement integrity and authentication controls in the updating mechanisms: mandatory digital signatures for binaries, HTTPS with rigid source validation and checksum verification. Distribution servers should be protected with strong authentication and change audits, and any remote configuration file should not allow direct binary execution without prior verification. Microsoft offers good material on security measures for the supply chain that should be reviewed: Supply Chain Security Guide (Microsoft).

In endpoints and networks, it is critical to enable application control mechanisms and permitted lists (e.g. AppLocker or Windows execution controls), deploy EDR solutions that detect injection in reliable processes and monitor unusual outbound traffic patterns to unknown or C2-related domains. The hardening of public servants, the rotation of credentials, the principle of minimum privileges and the segmentation of networks to isolate critical systems significantly reduce the exploitable surface.

Incident response teams should pay attention to commitment indicators associated with DLL side-rolling, unusual processes linked to OneDrive or synchronization processes, and to staging domains and servers reported by researchers. Sharing intelligence and corroborating suspicious annexes or activities with national suppliers and CERTs accelerates containment. For the group's historical profile and capabilities, see MITRE ATT & CK, which collects associated tactics and techniques: MITRE ATT & CK - APT32 (OceanLotus).

For individual users and small investors using platforms such as Metakit, it is appropriate to download updates only from verified sources (official site or signed channels), to check verification amounts if the supplier publishes them and, where possible, to run trading applications in separate environments or dedicated virtual machines. Avoid day-to-day administrator privileges and activate the protection against malicious code execution in the system reduces the risk of dropper exploitation.

Finally, the persistence of actors such as OceanLotus shows a broader lesson: technological security is not just a matter of patches, but of the design of trust in the whole chain - from the developer to the user - and of organizational will to apply continuous good practices. Monitoring, transparency in updating mechanisms and collaboration between suppliers, companies and agencies are essential measures to limit the impact of targeted campaigns and digital espionage at national level.