OceanLotus SPECTRALVIPER Injected into OneDrive.Sync.Services.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.