Loading story…
Elastic Security identified an ongoing intrusion against a Vietnamese financial-services institution in which APT32/OceanLotus deployed the PHOREAL, also known as RIZZO, Windows backdoor. The assessment was made with high confidence based on PHOREAL's historical exclusive association with the Vietnamese threat group and victim targeting consistent with its known interests.
The attackers injected PHOREAL into the Microsoft-signed control.exe process using an unsigned tscon32.dll, then ran it from a private read-write-execute memory region—an in-memory evasion technique Elastic had not previously observed with the malware. PHOREAL used an RC4-encrypted command-and-control domain, thelivemusicgroup[.]com, resolving to 103.75.117[.]250; Elastic published YARA detection logic and endpoint and network observables to support hunting and remediation.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic created the Windows_Trojan_PHOREAL YARA rule for in-memory detection and released endpoint and network observables for remediation. The analyzed sample's RC4-encrypted C2 domain was thelivemusicgroup[.]com, which resolved to 103.75.117[.]250 at the time of analysis.
Elastic assessed with high confidence that APT32/OceanLotus conducted REF4322, citing PHOREAL's historical exclusive association with the group and the victim's alignment with its known targeting interests.
Elastic Security identified an ongoing intrusion campaign tracked as REF4322 targeting a Vietnamese financial-services institution. The campaign used the PHOREAL/RIZZO Windows backdoor, injected via an unsigned tscon32.dll into the Microsoft-signed control.exe process and executed from private RWX memory.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **OceanLotus** threat group, also tracked as **APT32** and **APT-C-00**, deployed an updated backdoor against company and government networks in East Asia. The intrusion chain relied on social-engineering lures, including double-extension decoy files and fake software installers such as `RobototFontUpdate.exe`, to deliver a multi-stage dropper and backdoor. The malware used layered obfuscation, encrypted payloads, and shellcode-based PE loading to hinder analysis and detection. The campaign also abused **DLL side-loading** through legitimate signed executables, including Symantec’s `rastlsc.exe`, to execute malicious components while appearing trustworthy. After installation, the backdoor established persistence through a Windows service or `Run` registry key, then communicated with command-and-control servers over TCP port `25123` with fallback HTTP/HTTPS channels. ESET said the malware gave operators broad post-compromise access, including host fingerprinting, file and registry manipulation, process execution, and the ability to load additional payloads.
Aug 14, 2026
Check Point Research detailed an **APT32 (Ocean Lotus)** backdoor sample that used control-flow obfuscation to frustrate reverse engineering while delivering a multi-stage infection chain. The attack began with a malicious document disguised as a **Qihoo 360** file, used **VBA macros** to inject shellcode into `rundll32.exe`, then decrypted and reflectively loaded a DLL before launching an auxiliary `HTTPProv.dll` module for command-and-control communications. The analysis showed the malware inserted junk basic blocks into functions, often by placing opposite conditional jumps that led to the same target, making flow graphs appear far more complex than they were. To counter that technique, the researcher released a Python-based **Graph Deobfuscator** plugin for **Cutter** and **radare2** using `r2pipe`, which patches those conditional branches into unconditional jumps in memory and reanalyzes the function graph without altering the original binary on disk by relying on radare2 cache mode.
Aug 14, 2026
Researchers linked multiple malware families to **OceanLotus**/**APT32** activity, showing the group used evolving backdoors and loaders in targeted intrusions against organizations in Vietnam and the automotive sector. Earlier analysis described **JEShell**, a Java-based second-stage backdoor deployed alongside **KerrDown**, with both malware families decoding layered shellcode to install or download a **Cobalt Strike Beacon** implant and, in some cases, sharing command-and-control infrastructure for redundancy. JEShell used an XOR-encrypted resource to unpack shellcode and inject it either into the current Java process on 32-bit systems or into a hardcoded `SysWOW64` process on 64-bit hosts. Later reporting tied a newer intrusion set to the same actor with moderate confidence, identifying a coordinated toolchain built around the **SPECTRALVIPER** backdoor, **P8LOADER**, and the **POWERSEAL** PowerShell runner. In observed attacks, a malicious DLL was dropped over SMB and launched through a renamed ProcDump binary, after which DONUTLOADER injected into `sessionmsg.exe` to deploy SPECTRALVIPER and then conditionally execute P8LOADER or POWERSEAL. SPECTRALVIPER supported HTTP and named-pipe C2, PE loading and injection, token impersonation, file transfer, and file-system manipulation, while POWERSEAL included AMSI and ETW bypasses; identified victims included large public companies in Vietnam, including agribusiness and financial services firms.
Aug 14, 2026