OceanLotus SPECTRALVIPER DLL Sideload via -uiDll Flag in Masqueraded Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects DLL sideloading behavior by the threat group OceanLotus (APT32), specifically targeting instances where legitimate Autodesk or HP Toolbox executables (Genuine.exe, Updater.exe, AutoCAD242.exe) are executed with the -uiDll command-line flag. This technique is used to load malicious DLLs (referred to as SPECTRALVIPER) from masqueraded, non-standard file paths such as %LOCALAPPDATA%\Autodesk or C:\Windows\appcompat, facilitating persistence and execution.