The state-linked cyber-espionage group OceanLotus (APT32) has extended its operations to target China’s Xinchuang technology ecosystem, a strategic framework designed to achieve IT self-reliance through domestic hardware and software.
New research indicates that the group is actively exploiting vulnerabilities and abusing locally developed platforms through spear-phishing and supply chain intrusions.
Sophisticated Lures Target ICT Innovation Platforms
Researchers observed multiple spear-phishing waves throughout 2025, using malicious attachments disguised as official policy documents and industry notices.
OceanLotus reportedly distributed .desktop, .jar, and .pdf lures specifically crafted to blend into the Xinchuang software environment.
One prevalent tactic involves malicious .desktop files, a Linux analog to Windows .lnk shortcuts, which execute embedded commands when opened via the “Exec” field.
A sample lure titled “Notice on Printing and Distributing the Minutes of the 2025 Meeting of the Energy Industry Shale Gas Standardization Technical Committee.pdf.desktop” triggers the creation of scheduled tasks for persistent command-and-control (C2) communication.
The group has also relied on JAR-based payloads, leveraging the widespread availability of Java in government and enterprise ICT terminals.
Filenames such as “The Path Dispute of the Asia-Pacific Free Trade Area and China’s Plan.jar” or “Energy Supply and Demand Statement.xls.jar” served as baits.
Once executed, these files verified the system environment before deploying downloaders like report-scheduler-1.0-SNAPSHOT.jar.
OceanLotus also used PDF lures to directly invoke WPS Office, tricking victims into opening documents hosted on remote-controlled servers.
A campaign themed around “Suggestions for Addressing International Maritime Disputes under the BBNJ Agreement” showcased the group’s adaptation to localized productivity suites.
Perhaps the most notable discovery came in mid-2025, when OceanLotus exploited CVE-2023-52076, a critical vulnerability in the Atril Document Viewer used in MATE desktop environments.
Through a malicious EPUB file titled “Safety Office Inspection Work – Final Version.epub”, the attackers achieved persistence by installing hidden autostart scripts and encrypted Python downloaders on victim systems.
Internal Supply Chain Compromise and Persistence
Beyond phishing, OceanLotus has escalated its efforts to compromise internal supply chains within Xinchuang-based networks.
Blackorbird Investigators noted that after initial access, often gained through spear-phishing, attackers attempted brute-force intrusions into internal security servers.
Following a month-long reconnaissance phase, they allegedly exploited an unknown vulnerability to push malicious updates to both ICT innovation systems and Windows terminals.
These findings highlight OceanLotus’s evolving strategies as it pivots toward Linux-based, domestically curated ecosystems, marking a significant shift away from its traditional focus on Windows environments.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
 has extended its operations to target China’s Xinchuang.){kind=link}