OceanLotus SPECTRALVIPER C2 Beacon via OneDrive Process Injection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects network activity associated with the SPECTRALVIPER malware family attributed to OceanLotus (APT32). The rule monitors for connections to known malicious C2 infrastructure (IPs and domains) and behavioral anomalies where the 'OneDrive.Sync.Services.exe' process makes outbound network connections to non-private addresses, which is indicative of process injection.