ESET_OceanLotus.pdf

**OceanLotus (APT32) backdoor analysis:** ESET documents a targeted multi‑stage campaign against East‑Asian organizations that uses deceptive droppers and fake installers, LZMA/RC4/encrypted shellcode-based PE loaders, DLL side‑loading of signed Symantec/McAfee binaries to execute a persistent backdoor, custom C2 mechanisms (TCP on port 25123 and an HTTPprov fallback using libcurl), extensive control‑flow obfuscation and a broad set of post‑compromise capabilities; the report includes detailed IoCs (hashes, domains, IPs, registry keys) and remediation indicators.