APT / THREAT GROUP

OceanLotus

aliases

Last seen:May 20, 2026

Intelligence Profile

According to PcRisk, Research shows that the OceanLotus 'backdoor' targets MacOS computers. Cyber criminals behind this backdoor have already used this malware to attack human rights and media organizations, some research institutes, and maritime construction companies.

The OceanLotus backdoor is distributed via a fake Adobe Flash Player installer and a malicious Word document (it is likely that threat authors distribute the document via malspam emails).

Threat Analysis

OceanLotus is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

Intelligence Reports Mentioning OceanLotus

OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack

The Hacker News· Jun 11, 2026

OceanLotus: From external espionage to domestic targeting

ESET Research· Jun 11, 2026

OceanLotus suspected of using PyPI to deliver ZiChatBot malware

Securelist (Kaspersky)· May 6, 2026

External References

→https://about.fb.com/news/2020/12/taking-action-against-hackers-in-bangladesh-and-vietnam/

→https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/

→https://bluecyber.hashnode.dev/apt32-malware-an-in-depth-analysis

→https://brandefense.io/blog/apt-groups/ocean-lotus-apt-group/

→https://cocomelonc.github.io/malware/2025/01/19/malware-tricks-44.html

Quick Facts

TypeAPT / Threat Group

Aliases2

Also Known As

osx.oceanlotusOceanLotus

External Intelligence

Malpedia: osx.oceanlotus

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search OceanLotus