Tag: OneDrive.Sync.Service.exe

Attack Groups

OceanLotus Targets Vietnam Investors With SPECTRALVIPER in FireAnt Supply Chain Attack

ESET has uncovered two campaigns by the Vietnam-aligned threat actor OceanLotus (APT32) targeting domestic entities and stock investors with the SPECTRALVIPER backdoor.…

APT32 backdoor CVE-2026-11645 cyber espionage

June 25, 2026

Cyber Products

OneDrive Sync Service Process

OneDrive.Sync.Service.exe is a legitimate Windows process used by OceanLotus for process injection to execute the SPECTRALVIPER backdoor.

OneDrive.Sync.Service.exe process injection SPECTRALVIPER

June 25, 2026