Loading malware…
SPECTRALVIPER is a heavily obfuscated, C++-written 64-bit Windows backdoor associated with the Vietnam-aligned OceanLotus threat actor, also known as APT32 and Canvas Cyclone. It has been used in cyberespionage operations against strategically significant Vietnamese organizations, including agribusiness, financial-services, infrastructure, transportation-construction, and stock-investment targets. The backdoor supports encrypted command-and-control over HTTPS and Windows named pipes; named-pipe communications use Diffie-Hellman key exchange and AES encryption. It can perform host reconnaissance, transfer and manipulate files and directories, load and inject PE payloads or shellcode into processes, conduct process hollowing, steal and impersonate security tokens, and adjust process privileges. SPECTRALVIPER can also support lateral movement through an orchestration model in which a C2-connected instance distributes commands to other compromised hosts via named pipes. Observed deployment chains have used DLL side-loading, process injection, and compromised software-update infrastructure. In a selective supply-chain operation targeting Vietnamese stock investors, a compromised investment-software update channel delivered a downloader that profiled hosts before selectively deploying SPECTRALVIPER. Other intrusions against Vietnamese organizations used side-loaded DLLs and likely exploitation of remote-code-execution vulnerabilities for initial access. Its control-flow flattening, dummy functions, and encrypted strings are intended to hinder static analysis and detection.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
SPECTRALVIPER is a heavily obfuscated, previously undisclosed, x64 backdoor that brings PE loading and injection, file upload and download, file and directory manipulation, and token impersonation capabilities.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Observed adversary tactics and techniques... Gather victim network information.
Observed adversary tactics and techniques... Gather host information.
Although the initial access vector was not directly observed, our analysis of victim's public-facing servers suggests that the attacker may have exploited remote code execution (RCE) vulnerabilities in a Microsoft SQL server to establish an initial foothold.
APT38 (Sapphire Sleet) compromised the Mastra npm supply chain to inject the “easy-day-js” dependency into more than 140 npm packages
In this operation, OceanLotus compromised the update server of FireAnt Metakit, a Vietnamese stock investment platform, and replaced legitimate software updates with a malicious payload that ultimately deployed SPECTRALVIPER.
MITRE ATT&CK techniques ... Execution T1059 Command and Scripting Interpreter SPECTRALVIPER was deployed using curl.
The group also targeted the construction firm, likely using remote code execution vulnerabilities, and deployed SPECTRALVIPER via DLL side-loading.
MITRE ATT&CK techniques ... Execution T1204 User Execution Users could have initiated the MetaKit update.
In pipe mode, SPECTRALVIPER opens a named pipe with a hardcoded name and waits for incoming commands.
DONUTLOADER shellcode ... attempted to inject into sessionmsg.exe. SPECTRALVIPER can load and inject executable files.
SPECTRALVIPER command handlers include CreateRundll32ProcessAndHollow and CreateProcessAndHollow.
SPECTRALVIPER possesses the ability to impersonate security tokens ... Commands include StealProcessToken, ImpersonateUser, RevertToSelf, and AdjustPrivileges.
SPECTRALVIPER is heavily obfuscated using control-flow flattening and custom AES string decryption; P8LOADER also obfuscates strings.
The adversary renamed the SysInternals ProcDump utility, used for collecting memory metadata from running processes, to masquerade as the Windows debugger utility (windbg.exe).
SysInternals ProcDump was renamed to windbg.exe and abused (-md) as a LOLBAS to load an unsigned malicious DLL.
DONUTLOADER shellcode ... attempted to inject into sessionmsg.exe. SPECTRALVIPER can load and inject executable files.
SPECTRALVIPER command handlers include CreateRundll32ProcessAndHollow and CreateProcessAndHollow.
SPECTRALVIPER possesses the ability to impersonate security tokens ... Commands include StealProcessToken, ImpersonateUser, RevertToSelf, and AdjustPrivileges.
Using the renamed ProcDump application with the -md flag, the adversary loaded dbg.config, an unsigned DLL containing malicious code... One example leveraged the Internet Explorer program (ExtExport.exe) to load a DLL, while another technique involved side-loading a malicious DLL (dnsapi.dll) using a legitimate application (nslookup.exe).
Due to the absence of signature validation, Metakit.exe executed the malicious downloader as a legitimate update.
Observed adversary tactics and techniques... System service discovery.
Observed adversary tactics and techniques... Remote system discovery.
SPECTRALVIPER command handler table includes GetCurrentUserName; the listed ATT&CK techniques include System owner/user discovery.
SPECTRALVIPER command handler table includes ListRunningProcesses; the listed ATT&CK techniques include Process discovery.
SPECTRALVIPER facilitates host reconnaissance, C2 communication, and lateral movement.
SPECTRALVIPER command handler table includes ListFiles; the listed ATT&CK techniques include File and directory discovery.
Observed adversary tactics and techniques... Network share discovery.
MITRE ATT&CK techniques ... Lateral Movement T1021 Remote Services The SPECTRALVIPER orchestrator can distribute commands to other instances.
The first event recorded was the creation of a file (C:\Users\Public\Libraries\dbg.config) by the System service dropped over SMB from a previously compromised endpoint.
SPECTRALVIPER also supports lateral movement through an orchestration model, in which one instance is designated as an orchestrator responsible for communicating with the C&C infrastructure. This orchestrator distributes commands to other compromised hosts via named pipe channels.
SPECTRALVIPER implements the Diffie-Helman key exchange protocol to exchange the key needed to encrypt and decrypt commands transmitted via the named pipe, which is AES-encrypted... cookie header... encrypted using RSA1024 asymmetric encryption and base64-encoded.
Indicators of Compromise (IOC) List Domains/URLs financemachinelearning.com leadingfilipinoteams.com coachcybersecurity.com gatewayrvcenter.com mxprodesign.com IP Address 38.60.245.37 ...
In HTTP mode, the malware will beacon to its C2 every n seconds ... The request contains a cookie header, euconsent-v2.
SPECTRALVIPER can download and upload files to and from the compromised system ... deliver additional malicious payloads to the infected machine.
It sends an initial beacon to a hardcoded URL, embedding encrypted host information inside the HTTP Cookie header.
Commands transmitted via the named pipe are AES-encrypted; HTTP cookie data is RSA1024-encrypted, with an AES key shared with the server.
SPECTRALVIPER can download and upload files to and from the compromised system. This allows the attacker to exfiltrate data.
207 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.