Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints

Part of the Earth Lusca story · since 16 Jun

Quiet for 20 weekslast report 17 Jun3 articles3 outlets
16 Jun · Infosecurity first26 Aug19 Sep13 OctNowThis article3rd of 3
  • Tue 16 Jun, 15:00 UTC. Infosecurity, first report. SprySOCKS backdoor gains Windows kernel stealth, hits governments.
  • Tue 16 Jun, 18:30 UTC. Dark Reading, its first report on the story. FishMonger uses new SprySOCKS backdoor with kernel drivers.
  • Wed 17 Jun, 08:28 UTC. Security Affairs, its first report on the story. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints. This article, 3rd of 3.

ESET researchers have identified two new Windows variants of the SprySOCKS backdoor, previously linked only to Linux, associated with the China-linked actor FishMonger. The variants, WIN_DRV and WIN_PLUS, leverage kernel drivers and the Print Spooler service to evade detection and target government organizations in Honduras, Taiwan, Thailand, and Pakistan. WIN_DRV employs a kernel driver to mask network connections, while WIN_PLUS uses the Print Spooler to inject malicious code.

Both variants enable commands such as system information collection and file manipulation. Additionally, there's speculation of a UEFI bootkit component exploiting a known Windows vulnerability, further complicating detection efforts for cybersecurity defenses.

How the story developed

All 3 articles
Quiet for 20 weekslast report 17 Jun3 articles3 outlets

3 articles from 3 outlets since 16 Jun. Quiet since 17 Jun. This was the 3rd report, 17 hours after the first.

Now16 Jun161718191 Nov2First reportInfosecurity · 16 Jun, 15:00This article3rd of 3 · day 1
  • Tue 16 Jun, 15:00 UTC. Infosecurity, first report. SprySOCKS backdoor gains Windows kernel stealth, hits governments.
  • Tue 16 Jun, 18:30 UTC. Dark Reading, its first report on the story. FishMonger uses new SprySOCKS backdoor with kernel drivers.
  • Wed 17 Jun, 08:28 UTC. Security Affairs, its first report on the story. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints. This article, 3rd of 3.
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 3 articles as a list
  1. Tue 16 JunDay 02
    1. SprySOCKS backdoor gains Windows kernel stealth, hits governments15:00 · Infosecurity · First report
    2. FishMonger uses new SprySOCKS backdoor with kernel drivers18:30 · Dark Reading
  2. Wed 17 JunDay 11
    1. China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints08:28 · Security Affairs · This article, 3rd of 3

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in