Loading story…
ESET attributed a targeted supply-chain attack to OceanLotus (APT32), saying the Vietnam-aligned espionage group compromised the update server for FireAnt MetaKit, a software component used by Vietnamese stock investors, and pushed malicious updates between October 2025 and March 2026. The tampered updates delivered a downloader that used DLL side-loading to install the SPECTRALVIPER backdoor, with researchers saying the operation was selective rather than a broad mass infection campaign. FireAnt MetaKit’s update process reportedly lacked integrity checks and TLS protection, allowing attackers to replace legitimate packages and abuse the trusted update channel.
Researchers said the malware used HTTPS for command-and-control, injected into OneDrive.Sync.Service.exe, and relied on infrastructure including financemachinelearning[.]com, while a parallel OceanLotus intrusion hit an unnamed Vietnamese infrastructure and transport construction company after suspected exploitation of remote code execution flaws in a public-facing Microsoft SQL Server. Multiple SPECTRALVIPER variants were then used for persistence, profiling, and lateral movement. The campaigns indicate a sharper OceanLotus focus on domestic Vietnamese surveillance, including targets tied to finance, infrastructure, and potentially politically sensitive anti-corruption and market investigations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The FireAnt MetaKit compromise continued until March 2026, selectively delivering malware to Vietnamese stock investors. ESET said the attack chain relied on missing update integrity validation, and one report also noted the absence of TLS protection in the update mechanism.
The campaign against the unnamed Vietnamese infrastructure and transport construction corporation remained active until February 2026. During the intrusion, multiple SPECTRALVIPER variants were deployed for persistence, profiling, and lateral movement.
Researchers said OceanLotus began a supply-chain attack against FireAnt MetaKit around October 2025, compromising its update server to target selected stock investors in Vietnam. The attackers abused the software's legitimate update mechanism to deliver a malicious downloader that led to deployment of the SPECTRALVIPER backdoor.
ESET reported that OceanLotus targeted an unnamed Vietnamese infrastructure and transport construction corporation, with the intrusion beginning in late 2024. The initial access vector was suspected to involve remote code execution flaws in a public-facing Microsoft SQL Server.
On 2026-06-11, reporting on ESET's findings publicly attributed two recent cyber espionage campaigns to the Vietnam-aligned threat actor OceanLotus. The disclosed campaigns centered on the SPECTRALVIPER backdoor and targeted domestic Vietnamese entities including stock investors and a construction-sector organization.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcewelivesecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **OceanLotus** threat group updated its macOS malware toolkit, extending a campaign long associated with targeted espionage. The revised malware was designed to compromise Apple systems used by selected victims and maintain covert access, showing that the group continued to invest in cross-platform capabilities rather than relying only on Windows-focused tooling. The report tied the activity to a broader pattern of **advanced persistent threat** operations in which OceanLotus adapts implants and delivery methods to fit the victim environment. The macOS update underscored the group’s focus on stealth, persistence, and intelligence collection, and highlighted that Apple endpoints were being actively targeted as part of the actor’s wider surveillance campaigns.
Jun 29, 2026
Amnesty International reported that Vietnamese human rights defenders and a rights organization were targeted in a coordinated spyware campaign attributed to **Ocean Lotus** (`APT32`) between 2018 and 2020. Identified victims included blogger and activist **Bui Thanh Hieu**, the nonprofit **VOICE** (Vietnamese Overseas Initiative for Conscience Empowerment), and another Vietnam-based blogger whose identity was withheld for safety reasons. The operation used phishing emails carrying malicious attachments or links, then delivered malware for **macOS** and **Windows** while displaying decoy documents to disguise the intrusion. On Windows systems, the attackers deployed **Kerrdown** and then **Cobalt Strike** to expand access and control over compromised devices. The activity fits a broader pattern of reporting on Ocean Lotus operations targeting Vietnamese civil society, media, and other entities, with multiple investigations describing the group as aligned with Vietnamese state interests, although Amnesty said it could not independently prove a direct link to the Vietnamese government. Amnesty said the surveillance campaign formed part of a wider environment of repression, censorship, arrests, harassment, and online restrictions affecting activists in Vietnam, and called for an independent investigation and tighter controls on surveillance technology.
Jun 29, 2026
Check Point Research attributed a set of tightly scoped cyber-espionage campaigns against **government and law enforcement** organizations in Southeast Asia to a China-linked activity cluster it tracks as **Amaranth-Dragon**, assessed as connected to the broader **APT41** ecosystem. Targeting was reported across **Cambodia, Thailand, Laos, Indonesia, Singapore, and the Philippines**, with lures aligned to local geopolitical events and infrastructure configured for stealth, including **geofencing** so command-and-control only interacted with victims in specific countries. The intrusion chain evolved over 2025, and—shortly after public disclosure—began weaponizing the WinRAR vulnerability **CVE-2025-8088** via malicious RAR archives to achieve code execution and persistence. Reporting describes Amaranth-Dragon using a custom **Amaranth Loader** to deliver encrypted payloads, with C2 infrastructure shielded behind **Cloudflare** and use of legitimate services (e.g., *Dropbox*) to stage content; Check Point also documented deployment of the **Havoc C2 framework** and a newly tracked **TGAmaranth RAT** that uses **Telegram bot-based C2** and includes anti-EDR/anti-AV features. Separate coverage notes CVE-2025-8088’s exploitation mechanics (including abuse of Windows **Alternate Data Streams (ADS)** to write to arbitrary locations such as Startup paths) and that multiple other threat groups have also exploited the flaw, underscoring ongoing operational risk beyond this single actor.
Jun 29, 2026