Loading story…
ESET reported that the China-linked espionage group FishMonger—also tracked as Earth Lusca, Aquatic Panda, Red Dev 10, and TAG-22—used two previously undocumented Windows variants of the SprySOCKS backdoor to target government organizations in Taiwan, Thailand, Pakistan, and Honduras during 2023 and 2024. The malware is described as a Windows evolution of a backdoor previously thought to be Linux-only and has also been linked to the Chengdu-based contractor iSoon. Researchers said the implants retained the Linux version’s command-and-control design and encryption while adding Windows-native capabilities and support for TCP, UDP, and WebSocket communications.
The two variants, WIN_DRV and WIN_PLUS, provide more than 30 command-and-control functions, including file and process management, SOCKS proxying, and keylogging. ESET said WIN_DRV uses malicious drivers such as RawWNPF and DriverLoader to hide processes, files, registry keys, and network connections, and to redirect TCP traffic through random ports to mask the real listening port, while WIN_PLUS is a simpler backdoor. Investigators also found signs that some intrusions may have involved a UEFI bootkit and possible exploitation of CVE-2023-24932, a Windows Boot Manager Secure Boot bypass flaw, although the evidence was not strong enough to tie that component to BlackLotus.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
ESET disclosed two previously undocumented Windows backdoor variants, WIN_DRV and WIN_PLUS, linked to FishMonger/Earth Lusca and described them as a Windows evolution of SprySOCKS. The researchers also noted indications that some attacks may have involved a UEFI bootkit and possible exploitation of CVE-2023-24932.
ESET reported that China-linked FishMonger/Earth Lusca used previously undocumented Windows variants of the SprySOCKS backdoor in attacks against government organizations in Taiwan, Thailand, Pakistan, and Honduras during 2023 and 2024. The malware added Windows-native capabilities, including kernel-level stealth and extensive command-and-control functions, to the previously known Linux malware family.
Trend Micro disclosed that the China-linked espionage group Earth Lusca was targeting government entities with a previously unseen Linux backdoor called SprySOCKS. The report said the campaign expanded in the first half of 2023 and used exploitation of internet-facing servers, web shells, and Cobalt Strike to support long-term espionage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcecommunity.gurucul.com
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceblogs.jpcert.or.jp
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-linked threat actor **Earth Lusca** expanded its operations globally while continuing to concentrate on Southeast Asia, Central Asia, and the Balkans, according to Trend Micro. Researchers recovered and decrypted a previously unseen Linux backdoor dubbed **SprySOCKS** from the group’s delivery infrastructure, linking it to campaigns targeting government departments involved in foreign affairs as well as organizations in the technology and telecommunications sectors. Trend Micro said SprySOCKS appears to be a Linux adaptation of the open-source Windows backdoor **Trochilus**, with an interactive shell resembling **Linux Derusbi** and a command-and-control protocol similar to **RedLeaves RAT**. The malware uses a two-part architecture consisting of a loader and an encrypted main payload, and multiple version markers indicate it remains under active development. Investigators also observed Earth Lusca using **Cobalt Strike** for lateral movement and aggressively exploiting public-facing servers through server-side **N-day vulnerabilities** to gain access.
Jun 29, 2026
Researchers disclosed **SockDetour**, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates **filelessly** and **socketlessly**, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least **July 2019**. Unit 42 linked the activity to the China-linked **TiltedTemple** cluster, also tracked by Microsoft as **DEV-0322**, and said the campaign overlapped with late-2021 intrusions involving **Zoho ManageEngine** exploitation; reporting also noted possible ties to **APT27** based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised **QNAP NAS** device that had likely been exploited through **`CVE-2021-28799`**, the same flaw previously abused to deploy **eCh0raix** and associated with earlier **QLocker** ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Aug 14, 2026
Researchers disclosed **Showboat**, a previously unreported modular Linux malware framework used since at least mid-2022 to compromise telecommunications organizations in the Middle East, Asia Pacific, and other regions. Black Lotus Labs said the malware operates as a post-exploitation backdoor that enables remote shell access, file transfer, host reconnaissance, persistence, process hiding, port mapping, and **SOCKS5 proxying**, allowing attackers to maintain access and pivot into internal systems not exposed to the internet. Investigators said the malware stayed largely undetected for months after a 2025 sample submission, highlighting the stealth of Linux-focused intrusions against telecom infrastructure. Infrastructure and victimology linked the activity with moderate confidence to one or more **China-aligned threat clusters**, with command-and-control nodes and related IP activity tied to **Chengdu, Sichuan**, and domains impersonating telecom brands in Southeast Asia. Reporting also connected the broader campaign to the deployment of a Windows implant, **JFMBackdoor**, through DLL sideloading, suggesting a cross-platform espionage operation against telecom providers. Confirmed or suspected victims included a telecom provider in the Middle East, an ISP in Afghanistan, entities in Azerbaijan, and networks in the United States, Ukraine, and the Donbas region, reinforcing concerns that shared malware tooling is being used across multiple PRC-linked operations.
Jun 29, 2026