OceanLotus DLL Sideload via -uiDll Flag (AutoCad242/Genuine/Updater)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects OceanLotus (APT32) activity utilizing DLL sideloading by executing renamed variants of Toolbox.exe (e.g., AutoCad242.exe, Genuine.exe, Updater.exe) with the '-uiDll' command-line flag to load masqueraded payloads with extensions like .json, .conf, or .log.