OceanLotus SPECTRALVIPER: FireAnt MetaKit Supply-Chain Masqueraded Process & C2

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

This rule detects activities associated with the OceanLotus (APT32) supply-chain compromise, specifically targeting the SPECTRALVIPER loader chain. It identifies the masqueraded execution of 'IntelAudioService.exe' and specific sideloading carriers (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' flag, the loading of the 'DtlCrashCatch.dll' malicious module, and network beaconing to known APT32 C2 infrastructure.