OceanLotus SPECTRALVIPER Side-loading Execution

Kaung Khant Ko@kaungkhantko

•updated Jun 12, 2026•1•0•4

Detects the execution of IntelAudioService.exe (a renamed dtlupdate.exe) using specific command-line arguments to side-load the SPECTRALVIPER backdoor. This activity is associated with OceanLotus (APT32) operations targeting Vietnam.