# OceanLotus: From external espionage to domestic targeting

DevFeed: [OceanLotus: From external espionage to domestic targeting](<https://devfeed.tech/articles/oceanlotus-from-external-espionage-to-domestic-targeting-8378.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/oceanlotus-external-espionage-domestic-targeting/>)

Author: ESET Research

Published: 2026-06-11T08:45:00Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [backdoor](<https://devfeed.tech/topics/backdoor.md>), [networking](<https://devfeed.tech/topics/networking.md>)

Tags: [apt](<https://devfeed.tech/tags/apt.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [backdoor](<https://devfeed.tech/tags/backdoor.md>), [dns](<https://devfeed.tech/tags/dns.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [linux](<https://devfeed.tech/tags/linux.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>)

## AI overview

The article analyzes OceanLotus's shift toward domestic espionage and two SPECTRALVIPER campaigns in Vietnam: a targeted supply-chain compromise of investor software and a prolonged intrusion against a construction corporation.

## Source excerpt

A shift in operational pattern of the infamous Vietnam-aligned APT group