Windows version of SprySOCKS Linux malware used to attack govt orgs

Windows variants for the SprySOCKS Linux malware have been used in attacks targeting government organizations in at least four countries.

SprySOCKS has been linked to the Chinese threat group ‘Earth Lusca,’ which deployed it in attacks against government entities focused on foreign affairs, technology, and telecommunications.

Now, ESET researchers discovered Windows variants of the same malware family that were used between 2023 and 2024 in attacks on government organizations in Taiwan, Thailand, Pakistan, and Honduras.

ESET attributes the activity with high confidence to the Earth Lusca threat actor, which they track as ‘FishMonger’ (also ‘Aquatic Panda,’ ‘Red Dev 10,’ and TAG-22).

Unlike the previously documented Linux version, the Windows variant adds kernel-level stealth capabilities allowing operators to hide malware artifacts and communicate with the backdoor through traffic redirected from arbitrary TCP ports

The two variants are WIN_DRV, which features kernel drivers for rootkit-like capabilities, and WIN_PLUS, a more barebones backdoor.

Both variants offer the following capabilities:

• Communicate over TCP, UDP, and WebSocket
• Support more than 30 command-and-control (C2) commands
• Collect system information
• Enumerate and manage processes and services
• List, create, delete, upload, download, copy, rename, and execute files
• Support SOCKS proxy functionality
• Can operate as both a client and a server
• Log keystrokes, clipboard content, and active window titles

The WIN_DRV variant includes the additional functionality of loading a driver named ‘RawWNPF’ directly into memory.

The driver is loaded from another kernel driver named ‘DriverLoader’ (fsdiskbit.sys) signed using a leaked certificate from the GitHub PastDSE project.

The driver enables the malware to hide processes via Windows API manipulation, hide network connections, hide files from directory listings, and hide malicious Registry key entries it uses for persistence.

Persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) via vds.exe for WIN_DRV, and registering the payload as a Windows Print Processor (VSPMsg) for WIN_PLUS.

Another observed feature allows inspecting incoming TCP traffic and redirecting specially crafted packets to the SprySOCKS backdoor. This enable communication without exposing the listening port.

“The WIN_DRV version […] enables TCP traffic diversion allowing the malware operators to send commands to the backdoor through a random TCP port on the victim’s device without exposing the backdoor's real listening port in the network traffic,” ESET explains.

ESET telemetry data also showed indications of a UEFI bootkit component that might exploit CVE-2023-24932, a Secure Boot flaw previously used as a zero-day by the BlackLotus UEFI malware.

However, no further details or strong evidence were provided to support a link to BlackLotus.

ESETS report provides a detailed technical analysis and indicators of compromise that could help organizations identify and protect against attacks using Windows versions of the SprySOCKS backdoor.

Although these variants are not new, their diacovery indicates that Earth Lusca has expanded its arsenal to target a more riverse variety of systems.

Test every layer before attackers do

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper