ESET Reveals New Findings on OceanLotus APT

Unveiling the Latest Shifts in OceanLotus Operations

Since its emergence, the OceanLotus group—also known as APT32—has long been recognized for executing some of the most sophisticated cyber espionage campaigns in Southeast Asia. Recent intelligence indicates a significant strategic transformation, marked by a shift from outward espionage to deeply embedded internal surveillance within Vietnam.

Strategic Rethink: Internal Focus Over External Attacks

Traditionally, OceanLotus targeted international organizations, foreign governments, and global corporations, utilizing advanced malware and social engineering tactics. However, 2024 onward reveals a pivot: an increased emphasis on internal targets, specifically focusing on Vietnamese institutions and infrastructure. This is not accidental but likely a calculated response to Vietnam’s intensified domestic anti-corruption drives.

Vietnam’s Crackdown Fuels Cyber ​​Espionage Tactics

Vietnam’s government has launched a large-scale anti-corruption campaign, Blazing Furnace, which has shifted the political landscape. These internal reforms open avenues for sophisticated cyber espionage, as malicious actors like OceanLotus aim to leverage internal vulnerabilities. This strategic pivot enhances their ability to monitor internal rivals and capture sensitive data pertinent to national security and economic stability.

Deep Dive Into Recent Campaigns

Two major campaigns exemplify this internal focus:

• 2024 Campaign: Targeted a Vietnamese infrastructure and construction company, exploiting a newly discovered security vulnerability. This attack involved deploying a custom-built backdoor, SPECTRALVIPER, which maintained persistent covert access.
• 2025-2026 Campaign: Used FireAnt MetaKit, a widely used software platform for securities trading in Vietnam, as a trojan horse for deploying long-term surveillance tools. The attackers hijacked the update infrastructure to silently install their malware, demonstrating precise control over internal corporate networks.

How SPECTRALVIPER Enhances OceanLotus’s Capabilities

SPECTRALVIPER serves as a powerful backdoor that remains operational even in the most secure environments, using unique network protocols that evade traditional detection methods. This malware allows OceanLotus to collect sensitive data, monitor internal communications, and even manipulate operational systems without alerting target organizations.

Operational Tactics and Techniques

OceanLotus’s sophisticated approach involves multiple layers of stealth, including:

• Deploying custom malware that adapts dynamically to the targeted environment
• Utilizing watering-hole attacks that infect trusted websites frequented by Vietnamese officials and industry leaders
• Hijacking software update channels to deliver malicious payloads, especially on platforms like MetaKit
• Implementing stealthy command-and-control protocols that blend with legitimate traffic

Implications of the Shift Towards Internal Espionage

The move reflects a mature threat actor strategy, emphasizing long-term intelligence gathering over broad external attacks. It indicates OceanLotus’s awareness of increased international scrutiny and a need to avoid detection while maximizing the value of the intelligence collected.

The Role of Vietnam’s Political Climate

Vietnam’s political environment is experiencing heightened anti-corruption efforts, with authorities cracking down on high-level officials and industry insiders. This creates fertile ground for state-sponsored cyber actors to align their operations with national security agendas. OceanLotus’s focus on internal targets could be a collateral effect or a strategic partnership aimed at consolidating influence within Vietnam’s internal power structure.

What This Means for Global and Local Stakeholders

Organizations operating within Vietnam, especially those involved in infrastructure, finance, or governmental sectors, face increased risk of internal espionage. Continuous monitoring, rigorous cybersecurity practices, and internal threat detection are essential to defend against these covert operations.

Conclusion

The recent activities of OceanLotus demonstrate a dangerous evolution—shifting from external espionage toward establishing long-term internal surveillance capabilities. By leveraging custom malware like SPECTRALVIPER and targeting vital domestic sectors, OceanLotus enhances its threat profile while aligning with Vietnam’s internal political and economic reforms. Staying ahead demands vigilance, as this trend signals increasingly targeted and covert cyber espionage campaigns that could shape regional stability for years to come.