Ocean Lotus Hits Vietnam Investors With SPECTRALVIPER in Fire Ant Attack
Summary: ESET attributed two OceanLotus campaigns to a SPECTRALVIPER backdoor: a supply chain attack using FireAnt Metakit's legitimate update URL to serve the malware to a small subset of Vietnamese stock investors from about October 2, 2025 to March 2026, and a prolonged intrusion at an unnamed Vietnamese infrastructure and transport construction corporation from November 2024 to February 2026. The FireAnt update configuration file at metakit.fireant[.]vn/Software/version.xml lacked signature validation, so Metakit.exe ran the malicious downloader as a legitimate update, leading to a DLL side-loading chain that injected into OneDrive.Sync.Service.exe and contacted the C2 server financemachinelearning[.]com.
Key Takeaway: The FireAnt attack ran through the vendor's own update server for roughly five months, and the only thing standing between a tampered setup.exe and execution was a version.xml with no integrity check. OceanLotus has been active since 2012 and stayed inside the construction firm for about 15 months, so a signed update channel and a short dwell time are the stakes here.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026