OceanLotus Targets Stock Investors in FireAnt MetaKit Supply

Gbhackers •Mayura Kathir • June 11, 2026

OceanLotus APT has executed a precision supply‑chain operation that implanted its SPECTRALVIPER backdoor into FireAnt MetaKit, a popular Vietnamese market‑data component. Telemetry collected from mid‑2024 through early 2026 shows OceanLotus (aka APT32) conducting two distinct campaigns: a long‑running espionage intrusion against a Vietnamese infrastructure and transport construction company, and a targeted supply‑chain compromise of FireAnt […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

OceanLotus Shifts Focus to Domestic Espionage with SPECTRALVIPER Attacks From mid-2024 to early 2026, the Vietnam-aligned APT group OceanLotus has intensified its focus on domestic espionage, utilizing the SPECTRALVIPER backdoor in two major campaigns. The first campaign targeted a Vietnamese infrastructure and transport construction company, while the second involved a supply-chain attack on FireAnt MetaKit, a stock investment platform, affecting investors in Vietnam. The SPECTRALVIPER malware, a sophisticated 64-bit Windows backdoor, was deployed to compromise systems and gather intelligence. This shift in tactics reflects a broader trend of increased domestic monitoring amid Vietnam's anti-corruption efforts. OceanLotus, also known as APT32, has a history of targeting dissidents and foreign corporations, but its recent activities indicate a strategic pivot towards local targets. The group remains active and continues to innovate its malware arsenal, suggesting ongoing threats to Vietnamese entities. 17 sources 76

Extracted Entities

OceanLotus Targets Stock Investors in FireAnt MetaKit Supply

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)