Loading malware…
SprySOCKS is a cross-platform backdoor used by the China-aligned cyberespionage group FishMonger, also known as Earth Lusca, against predominantly government organizations. First publicly documented on Linux in September 2023, it derives from the open-source Trochilus remote access tool. Windows variants designated WIN_DRV and WIN_PLUS were subsequently identified in activity during 2023–2024 targeting government entities in Honduras, Taiwan, Thailand, and Pakistan. Earlier Linux activity targeted government departments involved in foreign affairs, technology, and telecommunications.
SprySOCKS provides system reconnaissance, interactive shell access, process enumeration and termination, service management, file manipulation and transfer, remote execution, and SOCKS proxying. The Windows variants support more than 30 commands, communicate over TCP, UDP, and WebSocket, and can operate in client or server mode. Optional surveillance functionality records keystrokes, clipboard contents, and active window titles. Its architecture uses loaders and encrypted payloads, with Windows implementations retaining core command-handling and communication characteristics of the Linux version.
WIN_DRV uses a kernel-mode rootkit named RawWNPF to conceal processes, files, registry keys, and network connections. It can redirect specially marked traffic arriving at an open TCP port to the backdoor's hidden listening port. Its execution chain uses DLL side-loading and process injection, while persistence mechanisms include scheduled tasks and Image File Execution Options abuse. WIN_PLUS uses malicious print-processor registration for persistence and injects its loader into another process. Process doppelgänging is used to conceal backdoor execution. The initial-access vector for the observed Windows deployments remains undetermined.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Following up with updates on their use of a newly discovered backdoor named SprySOCKS
An ESET report in June 2026 ... documented FishMonger's use of a Windows backdoor called SprySOCKS in attacks targeting government entities in Honduras, Taiwan, Thailand, and Pakistan between 2023 and 2024.
China-aligned FishMonger (Earth Lusca) has ported its SprySOCKS backdoor to Windows and bolted on a kernel driver, RawWNPF, that hides processes, files, connections and registry keys — and turns any open TCP port into a covert C2 channel.
Researchers found two new Windows variants of the SprySOCKS backdoor, previously known only on Linux. Linked to the Chinese group FishMonger (I-SOON), it active targeted government entities between 2023 and 2024. The variants, WIN_DRV and WIN_PLUS, support over 30 commands across TCP, UDP, and WebSockets. WIN_DRV uses kernel drivers to hide itself and divert network traffic to mask its listening port. Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
69 distinct techniques documented for this family, organized by ATT&CK tactic.
SprySOCKS can collect information about the compromised device, including information about network interfaces and assigned IP addresses.
SprySOCKS can collect information about the compromised device, including: computer name, OS version, information about memory and CPU, current privileges, system language and version, current time, and more.
FishMonger has developed custom malware for its operations, including the SprySOCKS backdoor.
FishMonger gains entry via N-day flaws in internet-facing servers; ESET urges patching public-facing apps to cut the entry vector.
Persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) via vds.exe for WIN_DRV...
A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary.
Both variants offer the following capabilities: ... Support more than 30 command-and-control (C2) commands
The backdoor supports keylogging, clipboard capture, file transfer, SOCKS proxy, and remote shell via cmd.exe.
In addition, we noticed that the implementation of the interactive shell is likely inspired from the Linux variant of the Derusbi malware.
FishMonger has used Windows APIs to execute code within a victim’s system.
Both Windows variants implement over 30 C2 commands covering system enumeration, file management, service control, and keylogging.
The driver is loaded from another kernel driver named ‘DriverLoader’ (fsdiskbit.sys) signed using a leaked certificate from the GitHub PastDSE project.
which triggers a DLL side-loading sequence that installs the backdoor and its driver components.
Persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) via vds.exe for WIN_DRV...
A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary.
This driver hides the malware’s network connections, processes, files, and registry keys from standard monitoring tools.
Using Windows Filtering Platform filters it inspects IPv4 traffic and diverts TCP received on ANY open port to the backdoor’s hidden local port — but only when specially crafted magic data is present.
Most concerning, ESET found limited signs that some attacks may reach even deeper, into a UEFI bootkit that loads before Windows itself.
Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
Between them, they support more than 30 commands, spanning: Service creation, control and deletion
persistence is reinforced by registering that binary as an Image File Execution Options debugger for vds.exe.
On the device, the malware hides among legitimate, signed Windows files via DLL side-loading and sets itself to run at startup.
WIN_PLUS installs VSPMsg.dll as a print processor executed by spoolsv.exe.
Persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) via vds.exe for WIN_DRV...
A batch script stages components into %SystemRoot%\Fonts and creates a SYSTEM scheduled task (ApphostRagistreationVerifier) that DLL-side-loads the malicious tpsvcloc.dll via a renamed, signed Microsoft binary.
A first-stage loader runs as a print processor, then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor.
The loader decrypts its payload container ... injects the backdoor shellcode into svchost.exe via process doppelganging using a token stolen from spoolsv.exe.
Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
the loader spawns a new svchost.exe process using CreateProcessAsUserW with a token obtained from spoolsv.exe
Between them, they support more than 30 commands, spanning: Service creation, control and deletion
persistence is reinforced by registering that binary as an Image File Execution Options debugger for vds.exe.
On the device, the malware hides among legitimate, signed Windows files via DLL side-loading and sets itself to run at startup.
WIN_PLUS installs VSPMsg.dll as a print processor executed by spoolsv.exe.
The stealthier of the two, WIN_DRV, leans on a kernel driver that acts as a rootkit, hiding the malware's files, processes, registry keys and network connections so they never show up in tools like netstat.
A 2.7 MB ELF binary with near-maximum entropy (7.997 bits per byte across ~832 KB of code). The obfuscation isn't packing -- it's a custom code virtualizer or instruction-level transformation that renders static analysis effectively impossible without dedicated devirtualization tooling.
SprySOCKS components use dynamic API resolution.
SprySOCKS components are stored in an AES-encrypted file on the victim’s drive.
Both processes are ones that appear in normal Windows environments constantly, which makes the activity blend into background noise.
A first-stage loader runs as a print processor, then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor.
The loader decrypts its payload container ... injects the backdoor shellcode into svchost.exe via process doppelganging using a token stolen from spoolsv.exe.
The SprySOCKS loader removes original files from the deployment directory after copying them and setting up persistence.
SprySOCKS loader removes a service registry value associated with the previously installed malicious minifilter driver after executing the driver.
the loader spawns a new svchost.exe process using CreateProcessAsUserW with a token obtained from spoolsv.exe
SprySOCKS loader decrypts the SprySOCKS backdoor from an encrypted file. Additionally, most of the strings in the SprySOCKS components are encrypted.
Using Windows Filtering Platform filters it inspects IPv4 traffic and diverts TCP received on ANY open port to the backdoor’s hidden local port — but only when specially crafted magic data is present.
It uses the Windows Print Spooler service, spoolsv.exe , as its starting point... then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor.
SprySOCKS uses several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
Most concerning, ESET found limited signs that some attacks may reach even deeper, into a UEFI bootkit that loads before Windows itself.
Evidence suggests some attacks may have deployed a UEFI bootkit exploiting CVE-2023-24932.
It uses a kernel driver named RawWNPF, stored on disk as KW1B5206BDC1743FP.dat , to hide the malware’s network connections, running processes, files, and registry keys from any tool operating at the user level.
WIN_DRV has also been found to utilize kernel drivers to conceal the malware's network connections, processes, files, and registry keys.
WIN_DRV has also been found to utilize kernel drivers to conceal the malware's network connections, processes, files, and registry keys.
The driver is loaded from another kernel driver named ‘DriverLoader’ (fsdiskbit.sys) signed using a leaked certificate from the GitHub PastDSE project.
which triggers a DLL side-loading sequence that installs the backdoor and its driver components.
SprySOCK’s RawWNPF driver uses the KdDisableDebugger function to disable the kernel debugger, if active.
This driver hides the malware’s network connections, processes, files, and registry keys from standard monitoring tools.
To load the kernel driver without triggering Windows security checks, the attackers used a leaked code-signing certificate from the PastDSE project on GitHub.
fsdiskbit.sys signed with a leaked certificate from the GitHub PastDSE project to satisfy DSE.
and quietly adds a Windows firewall rule to let its traffic through.
The backdoor can also log keystrokes and clipboard contents when switched on
The most operationally significant capability is the backdoor's access to cloud instance metadata at 169.254.169.254 . This is the link-local address that every major cloud provider uses to serve instance credentials, API tokens, and configuration data to running workloads.
Both variants support the same command set: collecting system information, launching an interactive shell, enumerating running processes, listing services
SprySOCKS retrieves the active foreground window name as a part of its keylogging functionality.
Between them, they support more than 30 commands, spanning: Process enumeration and termination
Between them, they support more than 30 commands, spanning: System and network reconnaissance
Between them, they support more than 30 commands, spanning: File listing, transfer, deletion and execution
SprySOCKS can collect information about the compromised device, including current system time.
SprySOCKS uses several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
SprySOCKS components check for the presence of security and sandboxing product libraries ( snxhk.dll , SxWrapper.dll , SxIn.dll , SXIn64.dll , SbieDll.dll , and cmdvrt32.dll ) in their own processes.
SprySOCKS can collect information about the compromised device, including system language.
SprySOCK’s RawWNPF driver uses the KdDisableDebugger function to disable the kernel debugger, if active.
The backdoor can also log keystrokes and clipboard contents when switched on
The backdoor can also log keystrokes and clipboard contents when switched on
In addition to the TCP communication channel, SprySOCKS can contact its C&C using UDP and WebSocket channels.
Both variants reach their operators over three channels, TCP, UDP or WebSocket, and act as client or server.
The variants, WIN_DRV and WIN_PLUS, support over 30 commands across TCP, UDP, and WebSockets.
It also lets operators reach the backdoor without giving themselves away, quietly rerouting traffic from any open port to the backdoor's hidden one when a specific marker appears in the packet and keeping the real destination out of sight.
The backdoor supports keylogging, clipboard capture, file transfer, SOCKS proxy, and remote shell via cmd.exe.
Loaded by means of a variant of an ELF injector component known as mandibule, SprySOCKS is equipped to gather system information, start an interactive shell, create and terminate SOCKS proxy, and perform various file and directory operations.
initialising a SOCKS proxy
Both SprySOCKS variants communicate with their C2 server over TCP, UDP, and WebSocket.
Between them, they support more than 30 commands, spanning: File listing, transfer, deletion and execution
SprySOCKS uses base64 encoding in its custom C&C communication protocol.
Using Windows Filtering Platform filters it inspects IPv4 traffic and diverts TCP received on ANY open port to the backdoor’s hidden local port — but only when specially crafted magic data is present.
This includes collecting system information, launching an interactive console... initialising a SOCKS proxy, uploading/downloading files, and running existing files.
SprySOCKS uses nonstandard ports to communicate with the C&C.
SprySOCKS encrypts data sent to, and decrypts data received from, the C&C with 128-bit AES.
SprySOCKS’s RawWNPF driver hides the backdoor’s active connections from being enumerated when using network tools such as netstat.exe.
SprySOCKS can upload various files from the compromised system to the C&C.
Between them, they support more than 30 commands, spanning: Process enumeration and termination
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.