OceanLotus DLL Sideloading via Masqueraded Executables Loading Modules from Non-Standard Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects DLL sideloading patterns associated with OceanLotus (APT32), specifically targeting known sideloaded module filenames or legitimate processes loading modules from user-writable and non-standard directories using suspicious command-line flags.