OceanLotus APT Compromises Vietnamese Stock Platform in Supply Chain Attack Deploying SPECTRALVIPER Backdoor

ESET WeLiveSecurity reported on June 11 that OceanLotus (APT32) compromised the update server of FireAnt MetaKit, a Vietnamese stock investment platform, replacing legitimate software updates with a malicious payload from October 2025 through March 9, 2026 12. ESET detected the first malicious payload on October 2, 2025, and observed that only a small subset of exposed users ultimately received SPECTRALVIPER, despite the platform's broad install base 1. SPECTRALVIPER arrived via DLL side-loading into OneDrive.Sync.Service.exe and communicated over HTTPS with the command-and-control domain financemachinelearning[.]com; ESET noted the update mechanism lacked both signature validation and TLS encryption 12. ESET separately tracked a concurrent intrusion into a Vietnamese infrastructure and transport construction corporation from mid-2024 through February 2026, also deploying SPECTRALVIPER across multiple network hosts 134.