OceanLotus Renamed Toolbox.exe Side-Loading

Kaung Khant Ko@kaungkhantko

•updated Jun 12, 2026•3•0•9

Detects executions of specific renamed binaries (Genuine.exe, Updater.exe, AutoCAD242.exe) or the original Toolbox.exe utilizing the '-uiDll' flag. This is indicative of DLL side-loading behavior abused by OceanLotus to deploy the SPECTRALVIPER backdoor.