APT / state · Mon 27 Jul 2026 · 13:49 UTC
RT by @cyb3rops: Quick follow-up on the OceanLotus / APT-C-00 campaign from the recent 360 report - the one using disc-image delivery, Analyzer.exe DLL sideloading, and http://NTUSER.MAN persistence. We turned up more indicators tied to the same group, and both are barely detected: An ISO container (6/60) with the same anti-debug + long-sleep traits, seen via China on 2 Jun 2026. Billfish.rar (2/63), tagged persistence + anti-debug, seen via Japan on 24 Jul 2026 9130d7d2271e9cb118dd83907d9865cba547304a1f6c72743973efd59813df18 (ISO image) 0bae4acd83015b8447e90aec97efa2e81d136bfd512a69301d6187fed2e45c74 (Billfish.rar)
Filed UTCSource X ↗
<p>Quick follow-up on the OceanLotus / APT-C-00 campaign from the recent 360 report - the one using disc-image delivery, Analyzer.exe DLL sideloading, and <a href="http://NTUSER.MAN">NTUSER.MAN</a> persistence. …
Indicators
checking abuse.ch ThreatFoxChecking indicators against ThreatFox…
Get the next one first.
Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.