Loading malware…
SPECTRALVIPER is a heavily obfuscated 64-bit Windows backdoor associated with the Vietnam-aligned threat actor OceanLotus, also tracked as APT32 and Canvas Cyclone. It has been used in cyberespionage operations against strategically important Vietnamese targets, including large public companies, financial-services organizations, agribusiness, infrastructure and transport construction entities, and selected stock investors through a software supply-chain compromise.
The malware is written in C++ and supports encrypted command-and-control over HTTP and Windows named pipes. It performs host profiling and reconnaissance, transfers files, manipulates files and directories, loads and injects PE payloads for both x86 and x64 architectures, and can inject additional binaries or shellcode into target processes. Reported command handling also includes process listing, privilege adjustment, token theft, and token impersonation, enabling privilege escalation and broader post-compromise access. In some observed operations, SPECTRALVIPER functioned as an orchestrating backdoor that relayed commands and supported lateral movement across compromised hosts via named-pipe channels.
SPECTRALVIPER has been deployed through stealthy execution chains that abuse legitimate signed binaries, DLL side-loading, and process injection. Observed delivery and staging methods include malicious DLL loading via renamed legitimate tools, side-loading through trusted Windows utilities, and trojanized software updates in the compromise of FireAnt MetaKit, where selective victims received the backdoor through the legitimate update mechanism. In other intrusions, it was staged by DONUTLOADER and used alongside P8LOADER, a PE loader, and POWERSEAL, a PowerShell runner with AMSI and ETW bypasses.
The malware emphasizes defense evasion through heavy obfuscation, including control-flow flattening, dummy functions, and encrypted strings. Its operators have used it in long-running espionage campaigns from at least 2023 through 2026, with later reporting indicating a notable shift by OceanLotus toward domestic Vietnamese targeting. SPECTRALVIPER is best characterized as a modular espionage backdoor designed for covert persistence, privilege abuse, payload execution, and lateral expansion inside victim environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SPECTRALVIPER is a heavily obfuscated, previously undisclosed, x64 backdoor that brings PE loading and injection, file upload and download, file and directory manipulation, and token impersonation capabilities.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
Although the initial access vector was not directly observed, our analysis of victim's public-facing servers suggests that the attacker may have exploited remote code execution (RCE) vulnerabilities in a Microsoft SQL server to establish an initial foothold.
MITRE ATT&CK techniques ... Execution T1059 Command and Scripting Interpreter SPECTRALVIPER was deployed using curl.
The group also targeted the construction firm, likely using remote code execution vulnerabilities, and deployed SPECTRALVIPER via DLL side-loading.
The unsigned DLL (dbg.config) contained DONUTLOADER shellcode which it attempted to inject into sessionmsg.exe... SPECTRALVIPER can load and inject executable files... command handlers include InjectShellcodeInProcess, CreateProcessAndInjectShellcode, InjectPEInProcess, and CreateProcessAndHollow.
The binary code is heavily obfuscated... control flow flattening... SPECTRALVIPER’s strings are obfuscated using a custom structure and AES decryption... P8LOADER uses a C++ template-based obfuscation technique to obscure errors and debug strings.
The adversary renamed the SysInternals ProcDump utility, used for collecting memory metadata from running processes, to masquerade as the Windows debugger utility (windbg.exe).
SysInternals ProcDump was renamed to windbg.exe and abused (-md) as a LOLBAS to load an unsigned malicious DLL.
The unsigned DLL (dbg.config) contained DONUTLOADER shellcode which it attempted to inject into sessionmsg.exe... SPECTRALVIPER can load and inject executable files... command handlers include InjectShellcodeInProcess, CreateProcessAndInjectShellcode, InjectPEInProcess, and CreateProcessAndHollow.
Below is a table listing of the commands that were identified... CreateRundll32ProcessAndHollow ... CreateProcessAndHollow
Token Impersonation: The malware possesses the ability to impersonate security tokens... Observed adversary tactics and techniques... Access Token Manipulation: Make and Impersonate Token.
Using the renamed ProcDump application with the -md flag, the adversary loaded dbg.config, an unsigned DLL containing malicious code... One example leveraged the Internet Explorer program (ExtExport.exe) to load a DLL, while another technique involved side-loading a malicious DLL (dnsapi.dll) using a legitimate application (nslookup.exe).
Observed adversary tactics and techniques... System service discovery.
Observed adversary tactics and techniques... Remote system discovery.
Observed adversary tactics and techniques... System owner/user discovery.
SPECTRALVIPER facilitates host reconnaissance, C2 communication, and lateral movement.
MITRE ATT&CK techniques ... Lateral Movement T1021 Remote Services The SPECTRALVIPER orchestrator can distribute commands to other instances.
The first event recorded was the creation of a file (C:\Users\Public\Libraries\dbg.config) by the System service dropped over SMB from a previously compromised endpoint.
SPECTRALVIPER also supports lateral movement through an orchestration model, in which one instance is designated as an orchestrator responsible for communicating with the C&C infrastructure. This orchestrator distributes commands to other compromised hosts via named pipe channels.
SPECTRALVIPER implements the Diffie-Helman key exchange protocol to exchange the key needed to encrypt and decrypt commands transmitted via the named pipe, which is AES-encrypted... cookie header... encrypted using RSA1024 asymmetric encryption and base64-encoded.
Indicators of Compromise (IOC) List Domains/URLs financemachinelearning.com leadingfilipinoteams.com coachcybersecurity.com gatewayrvcenter.com mxprodesign.com IP Address 38.60.245.37 ...
In HTTP mode, the malware will beacon to its C2 every n seconds... The request contains a cookie header, “euconsent-v2”, which contains host-gathered information.
MITRE ATT&CK techniques ... Command and Control T1105 Ingress Tool Transfer A fake update downloaded and executed SPECTRALVIPER.
207 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used by OceanLotus in a supply-chain-enabled campaign targeting investors and construction-related companies.
A heavily obfuscated C++ x64 Windows backdoor used in espionage intrusions. It supports PE loading and injection, token theft and impersonation, file upload/download and file-system manipulation, can run as an EXE or masquerade as a DLL, and communicates over encrypted HTTP or named-pipe C2 channels.
A backdoor used by OceanLotus/APT32 for cyberespionage, including a supply-chain attack and a long-term intrusion in Vietnam.
A backdoor used by OceanLotus in espionage campaigns. It enables host reconnaissance, command-and-control communication, and lateral movement, and was delivered via a compromised software update mechanism and DLL side-loading.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.