SPECTRALVIPERMalware
Last reported 4 months ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1036Masquerading
“T1036”
- T1055Process Injection
“T1055”
- T1021Remote Services
“T1021”
- T1027Obfuscated Files or Information
“T1027”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1059Command and Scripting Interpreter
“T1059”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
OceanLotus: del espionaje exterior al foco en objetivos en Vietnam“Identificamos dos campañas distintas que emplean el backdoor SPECTRALVIPER: un ataque a la cadena de suministro dirigido a inversores bursátiles en Vietnam y una operación prolongada de espionaje contra una empresa vietnamita de construcción de infraes…”
-
OceanLotus: From external espionage to domestic targeting“We identified two distinct campaigns involving the SPECTRALVIPER backdoor: a supply-chain attack targeting stock investors in Vietnam and a prolonged espionage operation against a Vietnamese infrastructure and transport construction company.”
-
Elastic charms SPECTRALVIPER“Elastic charms SPECTRALVIPER”
Indicators in its reports
named in the reports above- metakit.fireant[.]vnin 2 reports
- hxxp://metakit.fireant[.]vn/Software/version.xmlin 2 reports
- 139.162.11[.]152in 2 reports
- 142.91.98[.]77in 2 reports
- hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement.htmlin 2 reports
- financemachinelearning[.]comin 2 reports
- gatewayrvcenter[.]comin 2 reports
- 139.180.128[.]42in 2 reports
- coachcybersecurity[.]comin 2 reports
- 139.99.33[.]239in 2 reports
- mxprodesign[.]comin 2 reports
- 166.88.77[.]186in 2 reports
- power-sync-services[.]comin 2 reports
- 103.119.47[.]104in 2 reports
- 511b77459673ec42…1d233b6c39fbin 2 reports
- 59a8553a4f8130f5…0be4d4da0e98in 2 reports
- 9ca1a5c7f79882db…26bcdcb9f6ddin 2 reports
- a8e2bbbfcb865003…12755ab0c165in 2 reports
- f74f1feb62b662cd…27824e55acb9in 2 reports
- f8f8209987ca7f13…e21bd2ae93a9in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.