OceanLotus APT Supply-Chain Attack Targets Stock Investors via Fire

A notorious advanced persistent threat (APT) group has executed a sophisticated supply chain attack, specifically targeting stock investors in Vietnam. The attackers compromised a widely used investment software platform, leveraging this access to deliver a powerful backdoor.

The operation, carried out by OceanLotus (also known as APT32), marks a notable shift in the group’s tactics as it turns focus increasingly toward domestic targets inside the country.

OceanLotus has been active since at least 2012 and is believed to be aligned with the interests of the Vietnamese government.

The group has historically targeted organizations across China and Southeast Asia, but recent tracking data shows it is now placing growing emphasis on surveillance within Vietnam itself.

The attack on FireAnt MetaKit represents a concerning new chapter in that ongoing shift.

Welivesecurity researchers said in a report shared with Cyber Security News (CSN) that they identified the campaign and noted that it ran from approximately October 2025 through March 2026.

The group compromised the update server of FireAnt MetaKit, a widely used stock market data delivery tool, and replaced legitimate software updates with a malicious payload. This trojanized update ultimately deployed SPECTRALVIPER, OceanLotus’s signature backdoor.

Despite the broad reach a supply chain attack of this kind could have, only a small subset of users actually received SPECTRALVIPER.

This selective delivery suggests the attackers were after specific individuals, likely tied to Vietnam’s ongoing anti-corruption investigations and financial market scrutiny. That level of precision shows the operational discipline that makes this threat group so dangerous.

The timing also carries important geopolitical weight. Vietnamese authorities had been conducting wide-ranging financial investigations after revelations that about 80 major companies misreported bond sales, causing a 5.5% drop in the country’s main stock index.

Researchers believe OceanLotus may have been supporting those domestic investigative efforts, acting as a digital arm of the state’s surveillance apparatus.

OceanLotus APT Compromises FireAnt MetaKit

FireAnt is a Vietnam-based fintech company offering real-time market data, technical analysis tools, and AI-driven investment insights.

MetaKit is a specialized software component within that ecosystem, designed to feed financial data directly into trading platforms like AmiBroker and MetaTrader.

On October 2, 2025, researchers detected the first malicious payload originating from FireAnt MetaKit’s legitimate update URL at http://metakit.fireant[.]vn/Software/setup.exe.

The update configuration file lacked any integrity validation mechanism, meaning there was nothing in place to verify whether the software being delivered was genuine.

Due to this gap, Metakit.exe silently executed the malicious downloader as if it were a routine update. The downloader then profiled the host machine and sent that data to a staging server to request the next-stage payload.

The attacker’s infrastructure evolved across the campaign. Command and control servers initially used the IP 139.162.11[.]152 before migrating to 142.91.98[.]77.

SPECTRALVIPER was then delivered via DLL side-loading, using a file named DtlCrashCatch.dll alongside a renamed executable called IntelAudioService.exe, which injected the backdoor into the OneDrive.Sync.Service.exe process.

SPECTRALVIPER Backdoor: Architecture and Capabilities

SPECTRALVIPER operates as a fully featured backdoor that communicates with its command and control server over HTTPS. It sends an initial beacon to a hardcoded URL, embedding encrypted host information inside the HTTP Cookie header.

In this campaign, the backdoor used the domain financemachinelearning[.]com, carefully crafted to blend into network traffic associated with stock market activity.

The malware supports lateral movement through an orchestration model, where one instance acts as a controller and distributes commands to other infected machines via named pipe channels.

It can also inject additional binaries or shellcode received from the server into target processes. Notably, an operational security mistake left internal class names intact in one sample, giving researchers a rare window into the backdoor’s underlying architecture.

Organizations relying on third-party investment tools should verify the integrity of software updates they receive, especially when those applications lack HTTPS-based update protocols.

FireAnt MetaKit’s update mechanism did not use TLS encryption, leaving it exposed to interception. Unsigned and unverified software updates should always be treated with the same caution as suspicious email attachments.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.