Loading story…
Researchers tied the PhantomLance Android espionage campaign to OceanLotus with medium confidence, linking it to a broader cross-platform operation that also included a newly identified macOS backdoor. The Android activity ran from at least 2016, with supporting infrastructure dating to late 2015, and spread through Google Play and third-party app stores by disguising malware as legitimate mobile applications. Investigators found that some apps were initially uploaded as clean software and later updated with malicious code, helping the operators evade marketplace screening.
The malware was built to steal sensitive device and user data, request permissions dynamically, download additional payloads, and in newer variants use Firebase Remote Config and multi-stage delivery to reduce detection. Victims were concentrated in South and Southeast Asia, particularly Vietnam, India, Bangladesh, and Indonesia, with several lure apps crafted for Vietnamese users. Analysts said overlaps in infrastructure, code, and tradecraft connected the Android spyware to previously reported OceanLotus operations targeting Android, macOS, and Windows, indicating a sustained, multi-platform surveillance effort.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
One PhantomLance sample was published on Google Play on November 6, 2019, illustrating the campaign's use of the official app store for distribution.
Kaspersky said PhantomLance Version 3 was active at least from 2016 to 2018, using a more obfuscated first-stage dropper and payloads signed with the CN=Ventoplex certificate.
Researchers found dozens of PhantomLance-related Android samples active since 2016 and observed around 300 infection attacks beginning that year across India, Vietnam, Bangladesh, Indonesia, Nepal, Myanmar, and Malaysia.
Kaspersky reported that PhantomLance infrastructure included a domain first registered in December 2015, marking the earliest dated infrastructure tied to the campaign.
Kaspersky analyzed the long-running PhantomLance Android spyware campaign and attributed the Android activity, including PhantomLance, to OceanLotus with medium confidence based on infrastructure, code, and tradecraft overlaps.
After being notified, Google removed the reported malicious PhantomLance application from Google Play.
Trend Micro published a report on a new macOS backdoor linked to OceanLotus, providing additional context for the broader actor ecosystem later connected to PhantomLance.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 86 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **OceanLotus** threat group updated its macOS malware toolkit, extending a campaign long associated with targeted espionage. The revised malware was designed to compromise Apple systems used by selected victims and maintain covert access, showing that the group continued to invest in cross-platform capabilities rather than relying only on Windows-focused tooling. The report tied the activity to a broader pattern of **advanced persistent threat** operations in which OceanLotus adapts implants and delivery methods to fit the victim environment. The macOS update underscored the group’s focus on stealth, persistence, and intelligence collection, and highlighted that Apple endpoints were being actively targeted as part of the actor’s wider surveillance campaigns.
Jun 29, 2026
ESET reported that the **OceanLotus** threat group, also tracked as **APT32** and **APT-C-00**, deployed an updated backdoor against company and government networks in East Asia. The intrusion chain relied on social-engineering lures, including double-extension decoy files and fake software installers such as `RobototFontUpdate.exe`, to deliver a multi-stage dropper and backdoor. The malware used layered obfuscation, encrypted payloads, and shellcode-based PE loading to hinder analysis and detection. The campaign also abused **DLL side-loading** through legitimate signed executables, including Symantec’s `rastlsc.exe`, to execute malicious components while appearing trustworthy. After installation, the backdoor established persistence through a Windows service or `Run` registry key, then communicated with command-and-control servers over TCP port `25123` with fallback HTTP/HTTPS channels. ESET said the malware gave operators broad post-compromise access, including host fingerprinting, file and registry manipulation, process execution, and the ability to load additional payloads.
Aug 14, 2026
**OceanLotus** (also tracked as **APT32**) conducted a broad cyber-espionage campaign targeting critics of the Vietnamese state, journalists, human rights activists, NGOs, foreign governments, hospitals, businesses, and media organizations. Reporting tied the group to spear-phishing, watering-hole attacks, malicious websites, fake news portals, social media personas, shortened links, malicious Android apps, and credential theft operations designed to surveil victims and selectively deliver malware. Individual targets included Vietnamese writer **Bui Thanh Hieu** and Berlin-based journalist **Marina Mai**, while researchers also linked the operation to compromised sites and surveillance activity across Cambodia, Laos, and the Philippines. Security firms and platform operators said the group maintained a long-running, well-resourced infrastructure and evolved its tradecraft from phishing-heavy operations to direct intrusions against high-value targets using **0-day** and **N-day** vulnerabilities. Observed tooling included **Cobalt Strike**, **Mimikatz**, **Empire**, DLL side-loading, PowerShell-based host profiling, custom loaders, and malware such as **Remy RAT**, with some activity linked by Facebook to **CyberOne Group** in Vietnam. Facebook said it removed accounts and pages, blocked associated domains, notified targeted users, and shared indicators and **YARA** rules with industry partners as researchers continued to document the group’s regional surveillance and lateral movement capabilities.
Aug 15, 2026