Skip to content
OriginalSign in
Image: Dark Reading

Dark ReadingRob Wright

FishMonger uses new SprySOCKS backdoor with kernel drivers

Part of the Earth Lusca story · since 16 Jun

Quiet for 20 weekslast report 17 Jun3 articles3 outlets
16 Jun · Infosecurity first26 Aug19 Sep13 OctNowThis article2nd of 3
  • Tue 16 Jun, 15:00 UTC. Infosecurity, first report. SprySOCKS backdoor gains Windows kernel stealth, hits governments.
  • Tue 16 Jun, 18:30 UTC. Dark Reading, its first report on the story. FishMonger uses new SprySOCKS backdoor with kernel drivers. This article, 2nd of 3.
  • Wed 17 Jun, 08:28 UTC. Security Affairs, its first report on the story. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints.

FishMonger, a threat group linked to China, has utilized a new Windows variant of the SprySOCKS backdoor to infiltrate government targets in countries such as Honduras, Taiwan, Thailand, and Pakistan. This version employs kernel drivers, enhancing its stealth capabilities. The backdoor's architecture includes two types: WIN_DRV and WIN_PLUS, with the former using kernel drivers to conceal its activities. ESET's analysis indicates it has been active since 2023.

The exact method of initial access is undetermined, but it is suspected that misconfigured or outdated public-facing applications may have been exploited. ESET has provided indicators of compromise to assist defenders.

How the story developed

All 3 articles
Quiet for 20 weekslast report 17 Jun3 articles3 outlets

3 articles from 3 outlets since 16 Jun. Quiet since 17 Jun. This was the 2nd report, 3 hours after the first.

Now16 Jun161718191 Nov2First reportInfosecurity · 16 Jun, 15:00This article2nd of 3 · day 0
  • Tue 16 Jun, 15:00 UTC. Infosecurity, first report. SprySOCKS backdoor gains Windows kernel stealth, hits governments.
  • Tue 16 Jun, 18:30 UTC. Dark Reading, its first report on the story. FishMonger uses new SprySOCKS backdoor with kernel drivers. This article, 2nd of 3.
  • Wed 17 Jun, 08:28 UTC. Security Affairs, its first report on the story. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Tue 16 JunDay 02
    1. SprySOCKS backdoor gains Windows kernel stealth, hits governments15:00 · Infosecurity · First report
    2. FishMonger uses new SprySOCKS backdoor with kernel drivers18:30 · Dark Reading · This article, 2nd of 3
  2. Wed 17 JunDay 11
    1. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints08:28 · Security Affairs

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in