SPECTRALVIPER: The Obfuscated Backdoor Behind an APT32 Espionage Set

Background

SPECTRALVIPER is a previously undisclosed backdoor uncovered during analysis of an intrusion set tracked as REF2754, which targeted a nationally important Vietnamese agribusiness. It does not travel alone: the same set deploys P8LOADER (an obfuscated x64 PE loader), POWERSEAL (a .NET PowerShell runner with built-in AMSI/ETW evasion) and DONUTLOADER shellcode used to stage the backdoor.

The activity is assessed as Vietnamese state-affiliated and overlaps with the group reported as APT32 / OceanLotus (also Canvas Cyclone). A related intrusion against a Vietnamese financial-services firm used the same malware families and deployment conventions, and both victims sit squarely on Vietnam’s strategic-interest map, capital and former state-owned enterprises on one side, national food-security supply chains on the other, consistent with an intelligence-gathering mission rather than financial crime.

What we observed

The intrusion chain is deliberately quiet and lives off legitimate tooling:

• A living-off-the-land foothold: the backdoor was dropped over SMB from an already-compromised endpoint, then loaded by abusing a renamed copy of the SysInternals ProcDump utility (masquerading as windbg.exe) with the -md flag to load an unsigned malicious DLL, a LOLBAS technique that hides the load behind a trusted binary. Variants also side-load a malicious dnsapi.dll via nslookup.exe, or load a DLL via Internet Explorer’s ExtExport.exe.
• Staged in memory: an unsigned DLL carried DONUTLOADER shellcode that was injected into sessionmsg.exe (the Microsoft Remote Session Message Server) to load SPECTRALVIPER, and from there the situational P8LOADER or POWERSEAL components, keeping the malicious code off disk and inside trusted processes.
• A capable backdoor: SPECTRALVIPER is a C++ x64 backdoor with 33-36 command handlers offering PE loading and injection (x86/x64), token theft and impersonation, file upload/download and full file/directory manipulation. It can run as an EXE or masquerade as a DLL exporting legitimate names (e.g. sqlite3), with its real entry point hidden among the exports.
• Two encrypted ways home: SPECTRALVIPER communicates over HTTP, beaconing at a random 10-99 second interval, protecting data with RSA-1024 plus AES and hiding it in a ‘euconsent-v2’ cookie, or over a Windows named pipe using a Diffie-Hellman key exchange and AES. The named pipe is created with no security attributes, so it is reachable by anyone on the host.
• Anti-analysis throughout: every family is heavily obfuscated with control-flow flattening and multi-level dummy functions, and AES-encrypted strings; POWERSEAL further patches AMSI and ETW in memory (via NtWriteVirtualMemory) to blind Microsoft Defender and event tracing before running attacker PowerShell.

SPECTRALVIPER intrusion chain

Every stage borrows a trusted binary or a trusted process. Signature detection struggles; memory and behaviour hunting is where this chain shows itself.

Attribution

The intrusion is assessed with moderate confidence as a Vietnamese state-affiliated operation that overlaps with prior reporting on APT32 / OceanLotus (Canvas Cyclone). The assessment rests on shared, largely bespoke tooling (SPECTRALVIPER, P8LOADER, POWERSEAL) reused across two Vietnamese victims, consistent deployment and naming conventions, and victimology that maps cleanly onto Vietnam’s national strategic priorities. As with any nation-state cluster judged on overlap rather than a smoking gun, treat the APT32 link as a strong lead rather than a certainty; the malware families themselves are documented with high confidence.

Confidence: 80%.

SPECTRALVIPER hides its own code from itself, control-flow flattened, strings AES-locked, then talks home two ways, so defenders only ever see half the conversation.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

Indicators of compromise

Defenders can block or hunt the following:

Detection

Copy-ready hunting query:

# Behavioural hunts for the SPECTRALVIPER / REF2754 (APT32) chain
# 1) Renamed ProcDump abused as a DLL loader (LOLBAS)
index=edr process_name="windbg.exe" command_line="* -md *"   OR (original_file_name="procdump*" AND process_name!="procdump*.exe")
# 2) DLL side-loading via nslookup / ExtExport (signed binary loading unsigned DLL from user path)
index=edr parent_process IN ("nslookup.exe","extexport.exe") OR (process_name IN ("nslookup.exe","extexport.exe") AND dll_signed=false)
# 3) Unbacked / floating shellcode in trusted processes (DONUTLOADER / P8LOADER)
index=edr (process_name IN ("sessionmsg.exe","RuntimeBroker.exe") AND memory_region_type="Private" AND thread_start_unbacked=true)
# 4) In-memory AMSI / ETW patching before PowerShell (POWERSEAL)
index=edr (api="NtWriteVirtualMemory" target IN ("amsi.dll","ntdll.dll")) OR event="amsi_bypass"
# 5) Unsecured named pipes and C2 domains
index=edr pipe_name IN ("\\.\pipe\raSeCIR4gg","\\.\pipe\ydZb0bIrT")  OR (index=dns domain IN ("stablewindowsapp.com","webmanufacturers.com","toppaperservices.com","hosting-wordpress-services.com","appointmentmedia.com"))

# Detection content: Elastic YARA -- Windows_Trojan_SpectralViper, Windows_Trojan_P8Loader, Windows_Trojan_PowerSeal.

Recommendations

• Detect on behaviour, not hashes: SPECTRALVIPER is heavily obfuscated and recompiled per target, so prioritise memory and behavioural detections, unbacked/floating executable regions in trusted processes, DLL side-loading, and LOLBAS abuse, over static signatures.
• Hunt the specific tells: renamed ProcDump (windbg.exe with -md), nslookup.exe/ExtExport.exe loading unsigned DLLs, and in-memory AMSI/ETW patching (NtWriteVirtualMemory into amsi.dll/ntdll.dll) immediately before PowerShell execution.
• Block and monitor the C2 domains, deploy the Elastic YARA rules (SpectralViper, P8Loader, PowerSeal), and alert on unsecured named pipes created without security attributes on servers.
• Constrain lateral movement: the foothold arrived over SMB from a peer, so enforce SMB segmentation, least-privilege admin shares, and monitoring of file writes to public/library paths (e.g. C:\Users\Public\Libraries) from remote hosts.
• Elevated targeting for strategic sectors: Vietnamese finance, agribusiness/food-security and government organisations, and their regional partners, should assume heightened APT32 interest and rehearse an IR playbook that assumes an obfuscated, memory-resident backdoor with token-impersonation capability.