OceanLotus Shifts Focus to Domestic Espionage with SPECTRALVIPER Attacks

From mid-2024 to early 2026 Vietnam-aligned APT OceanLotus (APT32) shifted focus to domestic espionage, deploying the SPECTRALVIPER 64-bit Windows backdoor in two campaigns — a prolonged intrusion into a construction/infrastructure firm and a supply-chain compromise of the FireAnt MetaKit investment platform — using techniques such as DLL side-loading, LOLBAS abuse, renamed ProcDump, named pipes (e.g., \.\pipe\raSeCIR4gg), AES with Diffie-Hellman key exchange, and malicious update servers; the report provides indicators, timelines, affected sectors, and mitigation recommendations.