ESET links Windows SprySOCKS activity to Earth Lusca (FishMonger)
ESET researchers say they have found Windows variants of the SprySOCKS malware family that were used between 2023 and 2024 against government organizations in Taiwan, Thailand, Pakistan, and Honduras. The activity is attributed with high confidence to the Chinese-linked threat actor Earth Lusca, which ESET also tracks under the names ‘FishMonger,’ ‘Aquatic Panda,’ ‘Red Dev 10,’ and TAG-22. ESET published a detailed technical analysis and indicators of compromise intended to help organizations identify and protect against these attacks.
Two Windows variants: WIN_DRV and WIN_PLUS
The Windows deployments fall into two discrete variants. WIN_DRV contains kernel drivers that give the malware rootkit-like capabilities; WIN_PLUS is described as a more barebones backdoor. Both variants are capable of communicating over TCP, UDP, and WebSocket, support more than 30 command-and-control commands, and can operate as both a client and a server. Common functions across both include system-information collection; process and service enumeration and management; comprehensive file operations (list, create, delete, upload, download, copy, rename, execute); SOCKS proxy functionality; and logging of keystrokes, clipboard contents, and active window titles.
Kernel-level stealth, driver loading, and persistence mechanisms
WIN_DRV adds kernel-level stealth features by loading a driver named ‘RawWNPF’ directly into memory. That driver is loaded by another kernel driver called ‘DriverLoader’ (fsdiskbit.sys), which ESET says is signed using a leaked certificate from the GitHub PastDSE project. The loaded driver enables the malware to hide processes via Windows API manipulation, hide network connections, hide files from directory listings, and hide malicious Registry key entries used for persistence.
Persistence mechanisms differ by variant. For WIN_DRV, persistence is achieved via scheduled tasks and Image File Execution Options (IFEO) using vds.exe. WIN_PLUS registers the payload as a Windows Print Processor (VSPMsg) to maintain persistence.
TCP traffic diversion and covert command delivery
A notable feature observed by ESET inspects incoming TCP traffic and redirects specially crafted packets to the SprySOCKS backdoor. In practical terms, this allows operators to deliver commands through an arbitrary or random TCP port while keeping the backdoor’s true listening port hidden in network traffic. ESET’s quoted description frames this as deliberate TCP traffic diversion that conceals the backdoor’s real listening port from network visibility.
Telemetry hinting at a UEFI bootkit and the CVE-2023-24932 connection
ESET telemetry also showed indications of a UEFI bootkit component that might exploit CVE-2023-24932, a Secure Boot flaw previously used as a zero-day by other malware. ESET notes the telemetry but provided no further details or strong evidence to support a direct link to the earlier BlackLotus activity referenced in the advisory.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: ESET’s report includes detailed technical analysis and indicators of compromise that can be used to hunt for WIN_DRV and WIN_PLUS activity, including checks for the RawWNPF driver behavior, the signed DriverLoader (fsdiskbit.sys), IFEO and scheduled-task persistence, and the VSPMsg print-processor registration method.
- Policymakers and regulators: The attribution to Earth Lusca/FishMonger and the cross-border targeting of government organizations in Taiwan, Thailand, Pakistan, and Honduras underline the transnational nature of the activity ESET describes and the potential value of sharing IOCs and telemetry among affected national CERTs and international partners.
- Affected enterprises and procurement leaders: The discovery of Windows variants with kernel-level hiding and TCP diversion underscores the need to apply vendor guidance and threat-specific IOCs; ESET’s material is positioned as an immediate resource for detection and mitigation. The source also references a Picus whitepaper that shows how breach-and-attack simulation can test SIEM and EDR rules so threats stop slipping by detection.
ESET’s findings mark the Windows-stage evolution of a malware family previously seen on Linux and reveal operational choices — kernel drivers, signed loader components, TCP diversion and covert command channels, and print-processor persistence — designed to reduce network and host visibility. The report supplies actionable indicators and a technical map defenders can use now; one open thread in ESET’s telemetry is the hinted UEFI bootkit and its potential tie to CVE-2023-24932, where ESET offered suggestive telemetry but no firm linkage.
Read the original ESET-based coverage at BleepingComputer: https://www.bleepingcomputer.com/news/security/windows-version-of-sprysocks-linux-malware-used-to-attack-govt-orgs/
