We just published a blog post detailing the infrastructure, initial infection strategies, and payloads of the resurgent OceanLotus threat group: https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-s… A follow up post detailing the phishing activity and malware infrastructure is coming soon. Comments welcome! -- Thanks, Andrew (@attrc)