Adversary Intelligence — 2026-06-14

ESET Reveals Vietnam-Aligned OceanLotus APT Shifted From Foreign Espionage to Domestic Targeting Using SPECTRALVIPER Backdoor

BLUFOceanLotus's pivot from foreign espionage to precision domestic collection against financial sector targets signals Vietnamese security services now treat cyber operations as an internal enforcement instrument.

ESET's WeLiveSecurity, publishing June 11, documented two OceanLotus (APT32) campaigns deploying the SPECTRALVIPER backdoor against domestic Vietnamese targets from mid-2024 through March 2026, a period ESET describes as reflecting the group's increasing focus on domestic surveillance over external espionage. 123 In the first campaign, October 2025 through March 2026, OceanLotus compromised FireAnt MetaKit's update server to deliver SPECTRALVIPER via DLL side-loading; ESET noted selective delivery to only a small subset of the platform's Vietnamese stock investor base. 14 The second campaign compromised a Vietnamese infrastructure and transport construction corporation from November 2024 through January 2026, with ESET reporting that victim server analysis suggested Microsoft SQL Server remote code execution vulnerabilities as the probable initial access vector. 1

Analysis
The selective delivery of SPECTRALVIPER to only a fraction of FireAnt MetaKit's user base, despite full update-server access, indicates a precision targeting posture consistent with state-directed investigative collection. Both victim profiles map against active Vietnamese judicial proceedings: the construction intrusion predated October 2025 bond-fraud revelations; the investor campaign ran concurrent with regulators' securities-misreporting sweeps. Single-source ESET reporting warrants caution: the campaigns may instead reflect contract tasking by Vietnamese law enforcement, leaving OceanLotus's foreign-espionage mandate unchanged. An OPSEC failure exposing SPECTRALVIPER's internal class structure gives defenders rare cross-campaign architectural visibility. Vietnamese fintech providers using unencrypted update channels now carry elevated supply-chain exposure to the same actor.

4 sources

OceanLotus: From external espionage to domestic targeting - ESET WeLiveSecurity
OceanLotus targets stock investors and construction firm with SPECTRALVIPER backdoor - SC World
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack - The Hacker News
OceanLotus APT Compromises FireAnt MetaKit in Supply-Chain Attack on Stock Investors - Cybersecurity News