OceanLotus SPECTRALVIPER Code Signing Abuse - Spoofed Vendor Certs and Masqueraded PE Execution

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects process execution patterns associated with OceanLotus (APT32) SPECTRALVIPER sideloading chains. The rule identifies suspicious executables by name (masquerading), specific command-line flags ('-uiDll'), execution from known staging directories, or binaries using spoofed vendor metadata with invalid or absent digital signatures.