# OceanLotus: From external espionage to domestic targeting

OceanLotus compromised FireAnt MetaKit's update server and pushed a malicious setup.exe; unsigned version.xml updates let Metakit.exe run it, deploying SPECTRALVIPER to Vietnamese stock investors.

- Payout: Real-world hack
- Severity: critical
- Program: FireAnt MetaKit
- Analysis by: ESET Research
- Disclosed: 2026-06-11
- Write-up quality: 7/10
- Original: https://www.welivesecurity.com/en/eset-research/oceanlotus-external-espionage-domestic-targeting/
- Library page: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-oceanlotus-external-espionage-domestic-targeting
- Tags: area:oss domain:oss impact:data-leak impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:source-review vuln:misconfiguration

**Target:** Windows desktop update client (Metakit.exe) and update server version.xml
**Root cause:** The update configuration file version.xml and downloaded binaries lack any integrity/signature validation, and the update protocol is plain HTTP without TLS, so a compromised update server can serve arbitrary executables that Metakit.exe runs as legitimate updates.
**Steps:**
1. Compromise FireAnt update server at metakit.fireant[.]vn so http://metakit.fireant[.]vn/Software/setup.exe serves a malicious downloader.
2. Metakit.exe fetches version.xml (no integrity check) and executes the downloader as a legitimate update.
3. Downloader performs host reconnaissance and POSTs to staging server API `V1/Update/GetUpdate` to request next-stage payload.
4. Downloader drops side-loading chain: DtlCrashCatch.dll (SPECTRALVIPER loader) plus IntelAudioService.exe (renamed signed dtlupdate.exe).
5. Run `C:\Users\[redacted]\IntelAudio\Service\IntelAudioService.exe /appmodel /StateRepository /Service` to trigger DLL side-loading.
6. DtlCrashCatch.dll injects into OneDrive.Sync.Service.exe and runs in backdoor mode.
7. Backdoor beacons to `https://financemachinelearning[.]com/apparatus/wind/twig/statement.html` with encrypted host info in Cookie header prefixed `zd_cs_pm=`.
**How found:** ESET detected the first malicious payload originating from FireAnt MetaKit's legitimate update URL while the domain still resolved to the genuine server IP, indicating supply-chain compromise; reviewing the update protocol revealed version.xml lacked integrity validation and used plain HTTP.
**Exploitation:** Attacker controlled the legitimate update URL and served a downloader that Metakit.exe auto-executed due to missing signature validation; the downloader profiled the host, fetched SPECTRALVIPER via the GetUpdate API, side-loaded it through a renamed signed executable, injected into OneDrive.Sync.Service.exe, and beaconed to a themed C&C domain for command and exfiltration. Only a small subset of exposed investors received the backdoor, indicating selective targeting.
**Escalation:** SPECTRALVIPER loader injects backdoor into a host process; orchestrator instance distributes commands to other compromised hosts over named pipes for lateral movement.
**Insight:** Desktop trading/finance update clients that fetch a plaintext version.xml over HTTP and execute the referenced binary without signature checks are a supply-chain pivot: check whether the updater verifies signatures on both the manifest and the binary, and whether the manifest host is TLS-protected.

## Proof of concept (copied exactly from the original report)

**Side-loading execution command for IntelAudioService.exe**

```
C:\Users\[redacted]\IntelAudio\Service\IntelAudioService.exe /appmodel /StateRepository /Service
```

**SPECTRALVIPER beacon URL with cookie prefix**

```
https://financemachinelearning[.]com/apparatus/wind/twig/statement.html, embedding encrypted host information within the HTTP Cookie header. Historically, this data was prefixed with euconsent-v2=; however, in this campaign, we observed the use of the prefix, zd_cs_pm= (Figure 4), marking the first instance of this variation.
```

**Malicious update URL from FireAnt server**

```
http://metakit.fireant[.]vn/Software/setup.exe. The domain resolved to the genuine IP address of the FireAnt update server, suggesting a supply-chain compromise scenario.
```