September 11, 2026
- OceanLotus (APT32) is still shipping a custom XOR shellcode loader that decrypts and runs in memory, delivered in ISO/IMG chains with low AV coverage (Nextron). · Sep 11 · observed · as oceanlotos · Threat Intelligence
threat actor · VN
APT32
also tracked as oceanlotos 1, oceanlotus 1
2 stories · 1 in the wild · July 23, 2026 – September 11, 2026
evidence: 1 observed · 1 disclosed
how they got in
- phishing email 1 · Jul 23
techniques
- dll sideloading 1 · Jul 23
- persistence 1 · Jul 23
- spear phishing 1 · Jul 23
attack phases seen
- Execution 1 · Sep 11
- Initial access 1 · Jul 23
- Persistence 1 · Jul 23
what we reported, newest first, grouped by story
July 23, 2026
- OceanLotus initial-access chain detailed. Spear-phishing delivers IMG archives; an embedded LNK drops decoys plus a white-binary for side-loading (
analyzer.exeloading maliciousmglobal.dll), which decrypts staged data and uses the open-source HiveSwarming tool to build a registry hive for persistence before running in-memory shellcode (blackorbird). · Jul 23 · disclosed · via phishing email · as oceanlotus · Threat Activity