Excerpt
ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger, the group believed to be operated by a Chinese contractor named I‑SOON. While we initially discovered the malware samples on VirusTotal, ESET telemetry shows real activity between 2023 and 2024, with several victims in Honduras, Taiwan, Thailand, and Pakistan, targeting mostly government organizations.
The Windows variants discovered are internally marked as WIN_DRV and WIN_PLUS. Both come with a hardcoded C&C configuration and suppor…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by ESET on welivesecurity.com.
Mentioned in the excerpt
More from ESET16
- ceranakeeper.pdfESET · Added 17 Oct
- Killing me gently: Inside Gentlemen’s EDR killer frameworkESET · Added 23 Sep
- Beware the SparroWock: The backdoor that bites, the commands that catchESET · Added 23 Sep
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun
