OceanLotus SPECTRALVIPER Downloader Staging via POST /V1/Update/GetUpdate

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the SPECTRALVIPER downloader component characteristic of OceanLotus activity. The rule monitors for a specific HTTP POST request to a check-in URL, followed by the execution of IntelAudioService.exe with command-line arguments indicating a side-loading attack chain from the appmodel StateRepository.