Skip to content

CyberSIXT Search

Threat actor

FishMonger

China

Tracked by CyberSIXT since 16 Jun

Articlesall time: 3
Articleslast 30 days: 0
CVEs exploitedattributed · all time: 0
Research reportsall time: 2

5 articles from 3 outlets since 20 May; the latest 127 days ago.

Article
First report
Research report

Show as table

FishMonger: articles
Published (UTC)	Outlet	Headline
Sun 21 Jun · 21:21 UTC	Security Affairs	Security Affairs flags 1.2M site supply chain breach
Wed 17 Jun · 08:28 UTC	Security Affairs	China-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit Hints
Tue 16 Jun · 18:30 UTC	Dark Reading	FishMonger uses new SprySOCKS backdoor with kernel drivers
Tue 16 Jun · 15:00 UTC	Infosecurity	SprySOCKS backdoor gains Windows kernel stealth, hits governments
Wed 20 May · 13:30 UTC	The Hacker News	Webworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph API

See the full timeline

Connections

18 tools

Malware and tools: Mimikatz, Tasklist, Cobalt Strike, certutil, PowerSploit, Nltest, Winnti for Linux, NBTscan, ShadowPad, KTLVdoor

Names and sources

12 names

Earth Lusca: CyberSIXT coverage, Malpedia, MISP Galaxy, MITRE ATT&CK®
AQUATIC PANDA: Malpedia, Microsoft, MISP Galaxy
BRONZE UNIVERSITY: Malpedia, Microsoft, MISP Galaxy
BountyGlad: Malpedia, MISP Galaxy
CHROMIUM: Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
Charcoal Typhoon: Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
ControlX: Malpedia, Microsoft, MISP Galaxy, MITRE ATT&CK®
FISHMONGER: Malpedia, MISP Galaxy, CyberSIXT coverage

4 more names

Red Dev 10: Malpedia, MISP Galaxy
Red Scylla: Malpedia, MISP Galaxy
RedHotel: Malpedia, Microsoft, MISP Galaxy
TAG-22: Malpedia, MISP Galaxy, MITRE ATT&CK®

Attributed facts

Origin: China Microsoft · Charcoal Typhoon, MISP Galaxy
Category: State Microsoft · Charcoal Typhoon
Sectors: Covid-19 research organizations, Cryptocurrency, Education, Gambling companies, Government Institutions, Media and Entertainment, Medical, Pro-democracy and human rights political organizations, Religious organization, Telecommunications MISP Galaxy
Suspected victims: Australia, China, France, Germany, Hong Kong, Japan, Mongolia, Nepal, Nigeria, Philippines, Taiwan, Thailand, United Arab Emirates, United States, Vietnam MISP Galaxy

Malware and tools

MITRE ATT&CK® · G1006 9

certutil Cobalt Strike Mimikatz NBTscan Nltest PowerSploit ShadowPad Tasklist Winnti for Linux

Malpedia · earth_lusca 9

Dizzyvoid FishMaster FunnySwitch KTLVdoor Linux KTLVdoor Windows NjRAT ShadowPad SprySOCKS Linux SprySOCKS Windows

MITRE ATT&CK® techniques

44 techniques · 14 tactics

From MITRE ATT&CK® · G1006

Tactic coverageDistinct techniques recorded per ATT&CK tactic. The shape shows what the record covers, not activity or risk.

Reconnaissance: 1
Resource Development: 8
Initial Access: 3
Execution: 9
Persistence: 5
Privilege Escalation: 5
Stealth: 6
Defense Impairment: 1
Credential Access: 2
Discovery: 7
Lateral Movement: 1
Collection: 1
Command and Control: 1
Exfiltration: 1

Values by tactic

Reconnaissance: 1
Resource Development: 8
Initial Access: 3
Execution: 9
Persistence: 5
Privilege Escalation: 5
Stealth: 6
Defense Impairment: 1
Credential Access: 2
Discovery: 7
Lateral Movement: 1
Collection: 1
Command and Control: 1
Exfiltration: 1

Most recorded: Execution 9 · Resource Development 8 · Discovery 7

Reconnaissance1

T1595.002Vulnerability Scanning

Resource Development8

T1583.001Domains T1583.004Server T1583.006Web Services T1584.004Server T1584.006Web Services T1588.001Malware

+2 more

T1588.002Tool T1608.001Upload Malware

Initial Access3

T1189Drive-by Compromise T1190Exploit Public-Facing Application T1566.002Spearphishing Link

Execution9

T1047Windows Management Instrumentation T1053.005Scheduled Task T1059.001PowerShell T1059.005Visual Basic T1059.006Python T1059.007JavaScript

+3 more

T1204.001Malicious Link T1204.002Malicious File T1574.001DLL

Persistence5

T1053.005Scheduled Task T1098.004SSH Authorized Keys T1112Modify Registry T1543.003Windows Service T1547.012Print Processors

Privilege Escalation5

T1053.005Scheduled Task T1098.004SSH Authorized Keys T1543.003Windows Service T1547.012Print Processors T1548.002Bypass User Account Control

Stealth6

T1027Obfuscated Files or Information T1027.003Steganography T1036.005Match Legitimate Resource Name or Location T1140Deobfuscate/Decode Files or Information T1218.005Mshta T1574.001DLL

Defense Impairment1

T1112Modify Registry

Credential Access2

T1003.001LSASS Memory T1003.006DCSync

Discovery7

T1007System Service Discovery T1016System Network Configuration Discovery T1018Remote System Discovery T1033System Owner/User Discovery T1049System Network Connections Discovery T1057Process Discovery

+1 more

T1482Domain Trust Discovery

Lateral Movement1

T1210Exploitation of Remote Services

Collection1

T1560.001Archive via Utility

Command and Control1

Exfiltration1

T1567.002Exfiltration to Cloud Storage

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK

Subject articles only

Coverage

5 articles, all timeFull timeline RSS feed

21 JunSecurity Affairs flags 1.2M site supply chain breachSecurity Affairs
17 JunChina-Linked FishMonger Ports SprySOCKS to Windows With Kernel-Level Stealth and UEFI Bootkit HintsSecurity Affairs
16 JunFishMonger uses new SprySOCKS backdoor with kernel driversDark Reading
16 JunSprySOCKS backdoor gains Windows kernel stealth, hits governmentsInfosecurity
20 MayWebworm Deploys EchoCreep and GraphWorm Backdoors Using Discord and MS Graph APIThe Hacker News · first in our coverage

Research reports

Learn more