OceanLotus APT Uses FireAnt MetaKit Supply Chain Attack to Target Investors

Key Takeaways

• The advanced persistent threat (APT) group OceanLotus (APT32) conducted a supply chain attack targeting Vietnamese stock investors.
• The attackers compromised the update server of FireAnt MetaKit, a widely used investment software, to distribute their SPECTRALVIPER backdoor.
• The campaign, observed from October 2025 to March 2026, marks a strategic pivot for OceanLotus towards domestic surveillance within Vietnam.
• Only a select group of users received the malicious payload, suggesting a highly targeted operation likely connected to ongoing financial and anti-corruption investigations in Vietnam.

OceanLotus APT Compromises FireAnt MetaKit

A sophisticated supply chain attack orchestrated by the notorious advanced persistent threat (APT) group OceanLotus, also known as APT32, has specifically targeted stock investors in Vietnam. The attackers infiltrated a popular investment software platform, leveraging this breach to deploy a potent backdoor.

This operation signals a significant tactical evolution for OceanLotus, indicating an escalating focus on domestic targets within Vietnam. Active since at least 2012, OceanLotus is widely believed to operate in alignment with the interests of the Vietnamese government. While the group has historically directed its efforts towards organizations across China and Southeast Asia, recent intelligence suggests a growing emphasis on surveillance activities within Vietnam itself.

The compromise of FireAnt MetaKit represents a concerning new phase in this strategic shift. Researchers at Welivesecurity, in a report shared with Cyber Security News (CSN), identified the campaign as running from approximately October 2025 through March 2026. The group achieved its objective by compromising the update server for FireAnt MetaKit, a widely utilized tool for delivering stock market data. They replaced legitimate software updates with a malicious payload, a trojanized update that ultimately installed SPECTRALVIPER, OceanLotus’s signature backdoor.

Despite the potential for broad dissemination inherent in such a supply chain attack, only a limited number of users actually received the SPECTRALVIPER payload. This precise targeting implies that the attackers were pursuing specific individuals, likely those involved in Vietnam’s ongoing anti-corruption investigations and heightened scrutiny of financial markets. Such operational precision underscores the formidable capabilities of this threat group.

The timing of this campaign also carries significant geopolitical implications. Vietnamese authorities were concurrently conducting extensive financial investigations following disclosures that approximately 80 major companies had misreported bond sales, leading to a 5.5% decline in the nation’s primary stock index. Researchers postulate that OceanLotus may have been actively supporting these domestic investigative efforts, effectively acting as a digital extension of the state’s surveillance apparatus.

FireAnt MetaKit Vulnerability and Exploitation

FireAnt, a fintech company based in Vietnam, provides real-time market data, technical analysis tools, and AI-driven investment insights. MetaKit is a specific software component within this ecosystem, designed to feed financial data directly into trading platforms such as AmiBroker and MetaTrader.

On October 2, 2025, researchers detected the initial malicious payload originating from FireAnt MetaKit’s legitimate update URL: http://metakit.fireant[.]vn/Software/setup.exe. The critical vulnerability lay in the update configuration file, which lacked any integrity validation mechanism. This absence meant there was no way to verify the authenticity of the software being delivered.

Consequently, the Metakit.exe executable silently launched the malicious downloader, masquerading as a routine update. This downloader then profiled the compromised host machine and transmitted the collected data to a staging server to request the subsequent-stage payload.

The attacker’s infrastructure demonstrated adaptability throughout the campaign. Initial Command and Control (C2) servers utilized the IP address 139.162.11[.]152 before migrating to 142.91.98[.]77. SPECTRALVIPER was subsequently delivered via DLL side-loading, employing a file named DtlCrashCatch.dll in conjunction with a renamed executable, IntelAudioService.exe. This process injected the backdoor into the OneDrive.Sync.Service.exe process.

SPECTRALVIPER Backdoor: Architecture and Capabilities

SPECTRALVIPER functions as a full-featured backdoor, establishing communication with its command and control server over HTTPS. It initiates contact with a hardcoded URL, embedding encrypted host information within the HTTP Cookie header. For this campaign, the backdoor leveraged the domain financemachinelearning[.]com, a cleverly crafted address designed to blend seamlessly with legitimate network traffic associated with stock market activities.

The malware supports lateral movement through an orchestration model, where one infected instance acts as a controller, distributing commands to other compromised machines via named pipe channels. It possesses the capability to inject additional binaries or shellcode, received from the C2 server, into target processes. Notably, an operational security misstep by the attackers left internal class names intact in one sample, offering researchers a rare glimpse into the backdoor’s underlying architecture.

Organizations relying on third-party investment tools must rigorously verify the integrity of all software updates, particularly when those applications do not employ HTTPS-based update protocols. FireAnt MetaKit’s update mechanism notably lacked TLS encryption, leaving it vulnerable to interception. Unsigned and unverified software updates should always be treated with the same level of caution as suspicious email attachments.

What You Should Do

• Verify Software Update Integrity: Always confirm the authenticity and integrity of software updates, especially for critical financial applications. Look for digital signatures and ensure updates are delivered over HTTPS.
• Implement Strong Endpoint Detection and Response (EDR): Deploy and maintain robust EDR solutions to detect and respond to suspicious activity, including DLL side-loading and unusual process injections.
• Network Segmentation: Isolate critical systems and financial workstations on segmented networks to limit the lateral movement capabilities of attackers if a compromise occurs.
• Regular Security Audits: Conduct frequent security audits of third-party software and supply chain dependencies to identify and remediate potential vulnerabilities.
• User Awareness Training: Educate users, particularly those handling sensitive financial data, about the risks of supply chain attacks and the importance of verifying software sources.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.