OceanLotus SPECTRALVIPER DLL Sideloading via Masqueraded Legitimate Binaries

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects specific DLL sideloading patterns associated with the OceanLotus (APT32) group, specifically involving the SPECTRALVIPER loader. The rule monitors for known masqueraded binaries (e.g., intelaudioservice.exe, genuine.exe) loading suspicious files or executing with specific command-line arguments (e.g., -uiDll, /appmodel) indicative of malicious sideloading and persistence mechanisms.