Executive Summary
Between mid-2024 and March 2026, the Vietnam-aligned threat actor OceanLotus (APT32) exhibited a strategic shift toward domestic espionage. This period was characterized by two primary campaigns: a supply-chain compromise of the FireAnt MetaKit stock investment platform and a long-term intrusion into a major Vietnamese infrastructure and transport construction corporation. These operations appear to align with Vietnam's 'Blazing Furnace' anti-corruption campaign, suggesting the actor is providing technical support for state-led financial investigations.
Technically, OceanLotus utilized SPECTRALVIPER, a sophisticated C++ backdoor featuring orchestration and lateral movement capabilities. In the FireAnt campaign, the group exploited a lack of SSL/TLS and integrity validation in the software's update protocol to deliver malicious downloaders. In corporate environments, the group targeted public-facing servers, likely via Microsoft SQL RCE vulnerabilities, to establish a foothold before deploying side-loading chains to execute the backdoor.
The group's continued innovation is evident in their use of custom C2 protocols and orchestration frameworks. An operational security lapse allowed for the reconstruction of internal class structures like 'XGU::Pivot' and 'ProcessReflector', confirming the malware's high degree of modularity and its ability to act as both a loader and a persistent backdoor.