OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

OceanLotus, a Vietnam-aligned APT group, has been attributed to two distinct campaigns targeting Vietnamese domestic entities with the SPECTRALVIPER backdoor.

• •The first campaign targeted a Vietnamese transport construction corporation from mid-2024 to February 2026, exploiting public-facing SQL servers for initial access
• •The second campaign from October 2025 to March 2026 leveraged a supply chain attack on FireAnt Metakit, a popular stock investor platform, using the software's unvalidated update server
• •SPECTRALVIPER employs DLL side-loading with legitimate binaries to launch rogue DLLs (DtlCrashCatch.dll) that inject into OneDrive.Sync.Service.exe processes
• •FireAnt's update configuration file at metakit.fireant[.]vn/Software/version.xml lacked integrity validation, allowing direct malicious payload distribution