OceanLotus FireAnt MetaKit Supply-Chain: Malicious setup.exe Delivery

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•1

This rule detects potentially malicious activity associated with the MetaKit software, including DNS lookups to the 'metakit.fireant.vn' update server and the execution of 'setup.exe' processes spawned by parent processes associated with 'metakit'. This pattern is indicative of potential supply-chain execution or suspicious software update behavior.