Elastic charms SPECTRALVIPER

Elastic Security Labs details REF2754, a Vietnamese state-affiliated intrusion campaign that deploys a newly identified x64 backdoor called SPECTRALVIPER alongside P8LOADER (PE loader) and POWERSEAL (PowerShell runner) to achieve PE injection/loading, token impersonation, file exfiltration/manipulation, and defensive evasion (AMSI/ETW). The report includes execution flow, code and protocol analysis (HTTP and named-pipe C2 with encryption), YARA rules, hashes and domain IOCs, victimology focused on large Vietnam-based public companies, and moderate-confidence attribution to an APT linked to OceanLotus/Canvas Cyclone/APT32.