Fishmonger

FishMonger is a China-aligned cyberespionage threat actor associated with the broader Winnti ecosystem and widely tracked under aliases including Earth Lusca, TAG-22, Aquatic Panda, and Red Dev 10. Multiple public assessments link the group to the Chinese contractor I-SOON, also known as Shanghai Anxun Information Technology Co., Ltd., and characterize it as operating in support of Chinese state interests. The group has been active since at least 2019 and has conducted long-running espionage operations against government, diplomatic, religious, academic, NGO, think tank, telecommunications, technology, and other strategically relevant targets across Asia, Europe, and the Americas. FishMonger is known for targeting government organizations in particular, including campaigns observed in Taiwan, Thailand, Pakistan, Honduras, Hungary, Turkey, France, and the United States. It has also been linked to intrusions against universities in Hong Kong during the 2019 protest period and to broader operations aligned with Chinese geopolitical priorities. Reported victimology indicates a strong emphasis on intelligence collection rather than disruption. The actor uses a diverse malware arsenal that overlaps with tooling commonly seen across China-linked intrusion sets. Families associated with FishMonger include ShadowPad, SodaMaster, Spyder, SprySOCKS, FunnySwitch, BIOPASS RAT, Cobalt Strike, Winnti-related tooling, and the reverse-shell implant RPipeCommander. FishMonger has also been associated with watering-hole operations and with operational patterns overlapping other China-nexus clusters such as SixLittleMonkeys and Webworm, though those are distinct tracking clusters rather than confirmed sub-groups. A notable recent development is FishMonger’s expansion of the SprySOCKS backdoor from Linux to Windows. SprySOCKS had previously been documented as a Linux backdoor used in espionage against government and foreign affairs-related entities. Windows variants observed in 2023 and 2024 retained the malware’s cross-platform command-and-control design while adding Windows-specific persistence, stealth, and post-compromise capabilities. These variants supported extensive remote administration functions including system discovery, process and service control, file operations, remote execution, SOCKS proxying, and optional surveillance features such as keylogging and clipboard capture. FishMonger has demonstrated strong emphasis on stealth and persistence. Reported tradecraft includes DLL side-loading, scheduled-task persistence, abuse of print processor mechanisms, process doppelganging, credential theft, password interception, LSASS dumping, SAM hive theft, Firefox credential theft, and lateral movement using administrative tooling. In some SprySOCKS Windows intrusions, the group deployed kernel-mode components to hide processes, files, registry artifacts, and network connections, and to divert traffic in ways that reduce visibility to standard host-based tools. There are also limited but unconfirmed indications that some operations may have involved a UEFI bootkit exploiting CVE-2023-24932 for deeper persistence. FishMonger’s operations show a pattern of combining shared Chinese espionage malware with practical post-exploitation techniques. Observed behavior includes use of PowerShell, Impacket, network scanning, staging through compromised internal servers, and probable cloud-based exfiltration workflows. The group’s activity reflects a mature espionage operator focused on durable access, covert collection, and flexible reuse of modular tooling rather than noisy or destructive effects.