RT by @cyb3rops: Quick follow-up on the OceanLotus / APT-C-00 campaign from the recent 360 report - the one using disc-image delivery, Analyzer.exe DLL sideloading, and http://NTUSER.MAN persistence. We turned up more indicators tied to the same group, and both are barely detected: An ISO container (6/60) with the same anti-debug + long-sleep traits, seen via China on 2 Jun 2026. Billfish.rar (2/63), tagged persistence + anti-debug, seen via Japan on 24 Jul 2026 9130d7d2271e9cb118dd83907d9865cba547304a1f6c72743973efd59813df18 (ISO image) 0bae4acd83015b8447e90aec97efa2e81d136bfd512a69301d6187fed2e45c74 (Billfish.rar)

<p>Quick follow-up on the OceanLotus / APT-C-00 campaign from the recent 360 report - the one using disc-image delivery, Analyzer.exe DLL sideloading, and <a href="http://NTUSER.MAN">NTUSER.MAN</a> persistence. We turned up more indicators tied to the same group, and both are barely detected:<br /> <br /> An ISO container (6/60) with the same anti-debug + long-sleep traits, seen via China on 2 Jun 2026.<br /> Billfish.rar (2/63), tagged persistence + anti-debug, seen via Japan on 24 Jul 2026<br /> <br /> 9130d7d2271e9cb118dd83907d9865cba547304a1f6c72743973efd59813df18 (ISO image)<br /> 0bae4ac