MalwareUsed by 2 actorsExploits 1 CVE

PHOREAL

PHOREAL, also known as RIZZO, is a Windows backdoor associated with the Vietnam-aligned cyberespionage group APT32 (OceanLotus). It supports initial victim characterization and follow-on post-exploitation operations intended to compromise organizational data confidentiality. PHOREAL communicates with command-and-control infrastructure over ICMP, can create a reverse shell for interactive command execution, and modifies the Windows Registry to store its configuration. In a campaign targeting a Vietnamese financial-services institution, PHOREAL was loaded into private executable memory within a legitimate Microsoft-signed Windows process, reflecting an in-memory defense-evasion approach. APT32 has used PHOREAL in operations against organizations with interests in Vietnam, including public and private-sector entities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2016-7255Microsoft Win32k Elevation of Privilege VulnerabilityExploited in the wild

During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix.

via web archiveweb.archive.org

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT32

PHOREAL/RIZZO is a backdoor allowing initial victim characterization and follow-on post-exploitation operations to compromise the confidentiality of organizations’ data.

via elastic security labselastic.co

Group G0050

PHOREAL/RIZZO is a backdoor allowing initial victim characterization and follow-on post-exploitation operations to compromise the confidentiality of organizations’ data.

via elastic security labselastic.co

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

“APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros… APT32 actors continue to deliver the malicious attachments via spear-phishing emails.”

Execution

5 techniques

T1053.005Scheduled TaskEvidence1

“the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system.”

T1059.001PowerShellEvidence1

“delivered as a multi-stage PowerShell script… delivered as shellcode in a PowerShell script…”

T1059.003Windows Command ShellEvidence4

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1059.005Visual BasicEvidence1

“The Base64 encoded ActiveMime data also contained an OLE file with malicious macros.”

T1204.002Malicious FileEvidence1

“APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros.”

Persistence

2 techniques

T1053.005Scheduled TaskEvidence1

“the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system.”

T1112Modify RegistryEvidence8

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Privilege Escalation

2 techniques

T1053.005Scheduled TaskEvidence1

“the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system.”

T1055Process InjectionEvidence1

Alerts targeted the Microsoft-signed control.exe process, where the alerting thread's start_address_module was the unsigned C:\Windows\SysWOW64\tscon32.dll. The alerting memory region was private, committed RWX memory.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The analysis team "were able to extract an RC4 encrypted domain from an RCDATA resource"; the decrypted domain was thelivemusicgroup[.]com.

T1036MasqueradingEvidence2

“installed one backdoor as a persistent service with a legitimate service name… Another backdoor used an otherwise legitimate DLL filename…”

T1055Process InjectionEvidence1

T1218.005MshtaEvidence1

“This second task ran ‘mshta.exe’ every 50 minutes…”

Defense Impairment

1 technique

T1112Modify RegistryEvidence8

Command and Control

3 techniques

T1095Non-Application Layer ProtocolEvidence3

"Anchor has used ICMP in C2 communications." / "COATHANGER uses ICMP for transmitting configuration information..." / "PHOREAL communicates via ICMP for C2." / "Regin ... can use ICMP to communicate between infected computers." / "Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications."

T1105Ingress Tool TransferEvidence2

“Upon execution, the initialized file downloads multiple malicious payloads from remote servers.”

T1219Remote Access ToolsEvidence1

4H RAT has the capability to create a remote shell. AuditCred can open a reverse shell on the system to execute commands. PlugX allows actors to spawn a reverse shell on a victim. QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

INDICATORS OF COMPROMISE

IOCs tracked for this family

61 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

50 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

11 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

the hacker newsNews

Jun 11, 2026

OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

A malware tool identified as part of OceanLotus's arsenal.

eset welivesecurity blogNews

Jun 11, 2026

OceanLotus: From external espionage to domestic targeting

Backdoor used by OceanLotus that leverages ICMP for command-and-control communications.

elastic security labsNews

Jun 9, 2023

Elastic charms SPECTRALVIPER - Elastic Security Labs

An implant previously present on an overlapping victim environment tied to REF4322; mentioned as coexisting or preceding SPECTRALVIPER activity.

elastic security labsNews

Jun 9, 2023

Elastic charms SPECTRALVIPER

Previously observed implant on one endpoint in the REF4322 environment; it is mentioned as background to the subsequent SPECTRALVIPER infection.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching61

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PHOREAL