Skip to content
OriginalSign in
Image: Infosecurity

Infosecurity

SprySOCKS backdoor gains Windows kernel stealth, hits governments

Part of the Earth Lusca story · since 16 Jun

Quiet for 20 weekslast report 17 Jun3 articles3 outlets
16 Jun · Infosecurity first26 Aug19 Sep13 OctNowThis article1st of 3
  • Tue 16 Jun, 15:00 UTC. Infosecurity, first report. SprySOCKS backdoor gains Windows kernel stealth, hits governments. This article, 1st of 3.
  • Tue 16 Jun, 18:30 UTC. Dark Reading, its first report on the story. FishMonger uses new SprySOCKS backdoor with kernel drivers.
  • Wed 17 Jun, 08:28 UTC. Security Affairs, its first report on the story. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints.

The SprySOCKS backdoor, associated with a China-aligned espionage group known as FishMonger, has been upgraded to operate on Windows in addition to its existing Linux version. Recent ESET analysis identified two new Windows variants, WIN_DRV and WIN_PLUS, equipped with kernel-level stealth features that conceal their operations from detection tools. Active since 2023, the backdoor targets government organizations in various countries, including Honduras and Taiwan.

Key capabilities include system reconnaissance, process manipulation, and file management, along with keystroke logging. FishMonger is linked to a broader toolkit of malware, and concerns exist regarding potential UEFI bootkit attacks.

How the story developed

All 3 articles
Quiet for 20 weekslast report 17 Jun3 articles3 outlets

3 articles from 3 outlets since 16 Jun. Quiet since 17 Jun. This was the first report.

Now16 Jun161718191 Nov2First reportInfosecurity · 16 Jun, 15:00
  • Tue 16 Jun, 15:00 UTC. Infosecurity, first report. SprySOCKS backdoor gains Windows kernel stealth, hits governments. This article, 1st of 3.
  • Tue 16 Jun, 18:30 UTC. Dark Reading, its first report on the story. FishMonger uses new SprySOCKS backdoor with kernel drivers.
  • Wed 17 Jun, 08:28 UTC. Security Affairs, its first report on the story. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Tue 16 JunDay 02
    1. SprySOCKS backdoor gains Windows kernel stealth, hits governments15:00 · Infosecurity · First report · This article, 1st of 3
    2. FishMonger uses new SprySOCKS backdoor with kernel drivers18:30 · Dark Reading
  2. Wed 17 JunDay 11
    1. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints08:28 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in