OceanLotus Uses SPECTRALVIPER in FireAnt Supply-Chain Attack and Vietnamese Espionage Campaign
Summary
ESET researchers detail two OceanLotus campaigns from 2024–2026: a FireAnt MetaKit supply-chain compromise that delivered SPECTRALVIPER to some investors and a prolonged intrusion at a Vietnamese construction company.
Key points
- From October 2025 to March 2026, attackers compromised FireAnt MetaKit’s update channel and replaced legitimate updates with a malicious downloader; only a small subset of exposed investors received SPECTRALVIPER.
- The MetaKit update process lacked signature validation and used unencrypted HTTP, although researchers did not observe attackers exploiting the interception risk.
- SPECTRALVIPER used DLL side-loading and process injection; its C2 communications carried encrypted host information, and its orchestration feature enabled communication between compromised hosts through named pipes.
- A separate intrusion at a Vietnamese infrastructure and transport construction company persisted from around late 2024 to early 2026; researchers suspect, but did not confirm, initial access through Microsoft SQL Server RCE vulnerabilities.
- An OPSEC lapse left RTTI information in malware samples, helping researchers reconstruct parts of SPECTRALVIPER’s class structure and capabilities.
- Researchers observed no further malicious FireAnt updates after March 9, 2026, suggesting the supply-chain campaign had ended; they received no response to their attempts to notify FireAnt.
Article Details
- Attack Vectors
- OceanLotus compromised the FireAnt MetaKit update server and replaced legitimate updates with malicious payloads that deployed SPECTRALVIPER.
- The FireAnt MetaKit update protocol lacked integrity validation and used no SSL/TLS encryption for retrieving its configuration and updated binaries. The article reports these as vulnerabilities to interception, but says it did not observe OceanLotus exploiting interception in this campaign.
- The article assesses that attackers may have exploited remote code execution vulnerabilities in a Microsoft SQL server exposed by the infrastructure and transport construction corporation.
- SPECTRALVIPER was deployed through DLL side-loading. Its loader injected the backdoor into other processes, and its orchestrator distributed commands to other compromised hosts through named pipes.
- Defensive Notes
- Implement integrity validation and SSL/TLS encryption for software update configuration files and binaries.
- Validate update signatures before execution; the article identifies the absence of signature validation as enabling malicious updates to execute as legitimate.
- Review public-facing Microsoft SQL servers for exposure to remote code execution vulnerabilities; the article presents this as a suspected initial access route, not a confirmed one.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | coachcybersecurity[.]com | SPECTRALVIPER C&C domain observed during the corporate-network incident. |
| DOMAIN | financemachinelearning[.]com | SPECTRALVIPER C&C domain used in the stock-investor campaign. |
| DOMAIN | gatewayrvcenter[.]com | SPECTRALVIPER C&C domain observed in the corporate-network intrusion. |
| DOMAIN | leadingfilipinoteams[.]com | SPECTRALVIPER C&C domain. |
| DOMAIN | mxprodesign[.]com | SPECTRALVIPER C&C domain observed during the corporate-network incident. |
| DOMAIN | power-sync-services[.]com | SPECTRALVIPER C&C domain listed for the corporate-network incident. |
| IPV4 | 139[.]162[.]11[.]152 | SPECTRALVIPER staging server used to host the next-stage download. |
| IPV4 | 139[.]180[.]128[.]42 | SPECTRALVIPER C&C server. |
| IPV4 | 139[.]99[.]33[.]239 | SPECTRALVIPER C&C server. |
| IPV4 | 142[.]91[.]98[.]77 | SPECTRALVIPER staging server used to host the next-stage download. |
| IPV4 | 166[.]88[.]77[.]186 | SPECTRALVIPER C&C server. |
| IPV4 | 194[.]68[.]26[.]241 | SPECTRALVIPER C&C server. |
| IPV4 | 38[.]60[.]245[.]37 | SPECTRALVIPER C&C server. |
| SHA1 | 150764a71deef498de6f8c95ecccb4455c1b601f | SHA-1 of a SPECTRALVIPER backdoor. |
| SHA1 | 19a69f856efa811c376f68e4feb0997b4724f8bd | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 48febb91a10d1462461a012fafc0918bb028e947 | SHA-1 of a SPECTRALVIPER backdoor. |
| SHA1 | 490194e9bb5128eca8693ad9e610891c2ed185af | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 4ad36ad6c165b5174967020cb1a3358f78d7a283 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 51176139b0b2220b802c1578a4994df68df5bcd1 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 511b77459673ec42163f19e300ff1d233b6c39fb | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 57352b3ceee32216e5aa20baa848483d7ab5a6fb | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 59a8553a4f8130f576ab234e0b220be4d4da0e98 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 865a1739337d3303b3ab02c5e694c22b79c42b7d | SHA-1 of a SPECTRALVIPER backdoor. |
| SHA1 | 91f042f59be4bdcb6e5ea21b91decd731c175b54 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 9bc06df9f932746a05ee728c8b103bd3ba6bf395 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | 9ca1a5c7f79882db913534c1e62b26bcdcb9f6dd | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | a177ed0bffeb1efe1d9d31d72a82ef2625ae646d | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | a8e2bbbfcb86500322d2367744fa12755ab0c165 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | b0fea981d02f6f76de81ebaefcb68b7d205d6194 | SHA-1 of a SPECTRALVIPER backdoor. |
| SHA1 | b7b2d2db544f9eea74453cdf2b8beea58cf07c48 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | f74f1feb62b662cda489fdb2453727824e55acb9 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| SHA1 | f8f8209987ca7f139de6a62f9e6ee21bd2ae93a9 | SHA-1 of a SPECTRALVIPER downloader delivered from the FireAnt update server. |
| URL | hxxp[:]//metakit[.]fireant[.]vn/Software/setup.exe | Compromised FireAnt MetaKit update URL that delivered a malicious downloader. |
| URL | hxxps[:]//financemachinelearning[.]com/apparatus/wind/twig/statement.html | Hardcoded SPECTRALVIPER beacon URL used for C&C communication. |
MITRE ATT&CK
T1021 · Remote ServicesThe article says the orchestrator can distribute commands to other SPECTRALVIPER instances on compromised hosts.T1027 · Obfuscated Files or InformationThe article reports heavy obfuscation in stable downloaders and the backdoor.T1036 · MasqueradingSide-loading host executables were renamed, including variants presented as Genuine.exe, Updater.exe, and AutoCAD242.exe.T1041 · Exfiltration Over C2 ChannelThe article's ATT&CK table states that SPECTRALVIPER exfiltrates data over its C&C channel.T1055 · Process InjectionSPECTRALVIPER injects its backdoor component into processes, including OneDrive.Sync.Service.exe.T1059 · Command and Scripting InterpreterThe article's ATT&CK table states that SPECTRALVIPER was deployed using curl.T1071.001 · Web ProtocolsThe downloader and SPECTRALVIPER use HTTP/HTTPS for staging requests, beaconing, and C&C communication.T1082 · System Information DiscoveryThe downloader performed host reconnaissance and transmitted collected host information; SPECTRALVIPER also profiles hosts.T1105 · Ingress Tool TransferA malicious update downloaded the next-stage payload and SPECTRALVIPER.T1190 · Exploit Public-Facing ApplicationThe article suspects remote code execution exploitation of a public-facing Microsoft SQL server for initial access to the corporation.T1195.002 · Compromise Software Supply ChainOceanLotus compromised the FireAnt MetaKit update server and replaced legitimate updates with malicious payloads.T1204 · User ExecutionThe article says users could have initiated a MetaKit update, thereby starting execution of the malicious update.T1553.002 · Code SigningThe article's ATT&CK table says the attackers abused the lack of signature validation in the FireAnt MetaKit update protocol.T1570 · Lateral Tool TransferSPECTRALVIPER orchestration uses named-pipe channels to communicate between instances on compromised hosts.T1573 · Encrypted ChannelSPECTRALVIPER C&C communications are encrypted.T1574.002 · DLL Side-LoadingSPECTRALVIPER's loader DLL was executed through side-loading with companion executables.
Threat Actors
Malware
DenisIts well-known tools include Denis (aka SOUNDBITE), implementing DNS tunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxyPHOREALIts well-known tools include Denis (aka SOUNDBITE), implementing DNS tunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxySOUNDBITEIts well-known tools include Denis (aka SOUNDBITE), implementing DNS tunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxySPECTRALVIPERWe identified two distinct campaigns involving the SPECTRALVIPER backdoor: a supply-chain attack targeting stock investors in Vietnam and a prolonged espionage operation against a Vietnamese infrastructure and transportWINDSHIELDtunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxy bypass mechanism; and its latest backdoor, SPECTRALVIPER, which
Vendors
Products
FireAnt MetaKitFrom October 2025 to March 2026, OceanLotus carried out a supply-chain attack leveraging FireAnt Metakit, a software platform widely used by stock investors in Vietnam.Microsoft SQL Serversuggests that the attacker may have exploited remote code execution (RCE) vulnerabilities in a Microsoft SQL server to establish an initial foothold.
Countries
ChinaOceanLotus mainly targets China and Southeast Asia (with a focus on Vietnam); it has been associated with a variety of operations, ranging from a massive digital profiling campaign to highly targeted attacks againstVietnamDuring this period, the Vietnam-aligned OceanLotus adopted a more selective approach to external operations while placing increasing emphasis on domestic espionage.