OceanLotus Hacker Group Targeting Xinchuang IT Ecosystems to Launch Supply Chain Attacks

APT32 (OceanLotus) has launched a targeted surveillance campaign against China's Xinchuang IT ecosystem, using tailored spear-phishing (malicious .desktop files, JAR lures, weaponized EPUBs) and supply-chain techniques to exploit Atril Document Viewer (CVE-2023-52076) and deploy persistent, encrypted payloads and a Python-based downloader for long-term access and data exfiltration.