Loading malware…
SprySOCKS is a China-linked backdoor associated with the FishMonger espionage cluster, also tracked as Earth Lusca and assessed to operate under the broader Winnti umbrella. It was first documented as a Linux implant in 2023 and later expanded to Windows, reflecting a deliberate cross-platform evolution for long-term cyberespionage operations. Observed targeting has focused primarily on government organizations, especially entities involved in foreign affairs, technology, and telecommunications, with confirmed activity against victims in Asia and Central America during 2023 and 2024.
The malware is derived from the open-source Trochilus remote access tool but substantially modified. On Linux, SprySOCKS has been observed as a two-component implant consisting of a loader and an encrypted payload. Its capabilities include system information gathering, interactive shell access, SOCKS proxy creation, and file and directory operations. Reporting also links its design to tradecraft seen in other China-aligned malware families, including similarities in shell behavior and command-and-control protocol design.
Windows variants of SprySOCKS, internally referred to as WIN_DRV and WIN_PLUS, preserve the family’s core command-and-control architecture while adding Windows-native persistence and stealth. These variants support communications over TCP, UDP, and WebSocket and expose more than 30 commands covering reconnaissance, process and service control, file management, remote execution, and SOCKS proxying. Optional surveillance functionality includes collection of keystrokes, clipboard contents, and active window titles.
WIN_DRV is the more advanced Windows variant and incorporates kernel-mode stealth through a rootkit component that hides processes, files, registry keys, and network connections from userland tools. It also supports covert traffic diversion, allowing specially crafted traffic arriving on arbitrary open TCP ports to be redirected to the hidden backdoor listener, complicating network detection. Reported persistence and execution techniques include scheduled tasks, Image File Execution Options abuse, DLL sideloading, and process doppelganging.
WIN_PLUS is a lighter Windows variant that omits the kernel rootkit but still emphasizes stealth and persistence. It has been observed abusing the Windows Print Spooler subsystem through print processor registration and using process doppelganging to inject into system processes. Across both Windows variants, the malware is designed for durable remote access and covert operator control rather than disruptive effects.
SprySOCKS has been consistently linked to Chinese state-aligned espionage activity. FishMonger has used it alongside other established tooling such as ShadowPad, Spyder, Cobalt Strike, FunnySwitch, and BIOPASS RAT. Some reporting noted limited and unconfirmed indications that certain intrusions involving Windows SprySOCKS may also have included a UEFI bootkit component exploiting CVE-2023-24932, but that element remains unverified.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ESET also noted limited, unconfirmed evidence of a possible UEFI bootkit component (CVE-2023-24932). | China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys — and turns any open TCP port into a covert C2 channel.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FishMonger used SprySOCKS, WIN DRV, and WIN PLUS to enhance stealth and persistence against government organizations.
China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys — and turns any open TCP port into a covert C2 channel.
China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys — and turns any open TCP port into a covert C2 channel.
Researchers found two new Windows variants of the SprySOCKS backdoor, previously known only on Linux. Linked to the Chinese group FishMonger (I-SOON), it active targeted government entities between 2023 and 2024. The variants, WIN_DRV and WIN_PLUS, support over 30 commands across TCP, UDP, and WebSockets. WIN_DRV uses kernel drivers to hide itself and divert network traffic to mask its listening port. Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary.
The backdoor supports keylogging, clipboard capture, file transfer, SOCKS proxy, and remote shell via cmd.exe.
In addition, we noticed that the implementation of the interactive shell is likely inspired from the Linux variant of the Derusbi malware.
A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary.
This driver hides the malware’s network connections, processes, files, and registry keys from standard monitoring tools.
Using Windows Filtering Platform filters it inspects IPv4 traffic and diverts TCP received on ANY open port to the backdoor’s hidden local port — but only when specially crafted magic data is present.
Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary.
A first-stage loader runs as a print processor, then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor.
The loader decrypts its payload container ... injects the backdoor shellcode into svchost.exe via process doppelganging using a token stolen from spoolsv.exe.
Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
RawWNPF hooks NtQuerySystemInformation and nsiproxy.sys to hide processes, files, connections and registry keys.
A first-stage loader runs as a print processor, then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor.
The loader decrypts its payload container ... injects the backdoor shellcode into svchost.exe via process doppelganging using a token stolen from spoolsv.exe.
Using Windows Filtering Platform filters it inspects IPv4 traffic and diverts TCP received on ANY open port to the backdoor’s hidden local port — but only when specially crafted magic data is present.
It uses the Windows Print Spooler service, spoolsv.exe , as its starting point... then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor.
This driver hides the malware’s network connections, processes, files, and registry keys from standard monitoring tools.
Both variants support the same command set: collecting system information, launching an interactive shell, enumerating running processes
Both SprySOCKS variants communicate with their C2 server over TCP, UDP, and WebSocket.
The variants, WIN_DRV and WIN_PLUS, support over 30 commands across TCP, UDP, and WebSockets.
WIN_DRV uses kernel drivers to hide itself and divert network traffic to mask its listening port.
The backdoor supports keylogging, clipboard capture, file transfer, SOCKS proxy, and remote shell via cmd.exe.
Loaded by means of a variant of an ELF injector component known as mandibule, SprySOCKS is equipped to gather system information, start an interactive shell, create and terminate SOCKS proxy, and perform various file and directory operations.
Both SprySOCKS variants communicate with their C2 server over TCP, UDP, and WebSocket.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware used to enhance stealth and persistence in intrusions against government organizations.
A backdoor originally seen on Linux and now ported to Windows in two variants. It provides remote execution, reconnaissance, process/service control, file operations, and optional surveillance including keylogging and clipboard capture. The WIN_DRV variant adds a stealthy kernel-level rootkit capability via RawWNPF to hide processes, files, registry keys, and network connections, and can covertly divert traffic from any open TCP port into a hidden C2 channel.
A purpose-built backdoor derived from the open-source Trochilus remote access tool and used in espionage campaigns. The Windows variants support over 30 C2 commands including system enumeration, file management, service control, keylogging, clipboard capture, file transfer, SOCKS proxy, and remote shell. WIN_DRV uses the RawWNPF kernel driver to hide network connections, processes, files, and registry keys, while WIN_PLUS uses DLL side-loading, scheduled tasks, and print processor registry abuse for persistence.
A cross-platform backdoor originally known as Linux-only, now observed in two Windows variants. It supports TCP, UDP, and WebSocket C2 communications and can collect system information, launch an interactive shell, enumerate processes and services, initialize a SOCKS proxy, upload/download files, and execute files. The Windows variants add stealth via kernel drivers and Print Spooler abuse.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.